theory Detype_R

lemma createNewCaps_Cons:
  assumes cover:"range_cover ptr sz (Types_H.getObjectSize ty us) (Suc (Suc n))"
  and "valid_pspace' s" "valid_arch_state' s"
  and "pspace_no_overlap' ptr sz s"
  and "ptr \<noteq> 0"
  shows "createNewCaps ty ptr (Suc (Suc n)) us d s
 = (do x \<leftarrow> createNewCaps ty ptr (Suc n) us d;
      r \<leftarrow> RetypeDecls_H.createObject ty
             (((1 + of_nat n) << Types_H.getObjectSize ty us) + ptr) us d;
      return (x @ [r])
    od) s" proof - have append :"[0.e.(1::word32) + of_nat n] = [0.e.of_nat n] @ [1 + of_nat n]" using cover apply - apply (frule range_cover_not_zero[rotated]) apply simp apply (frule range_cover.unat_of_nat_n) apply (drule range_cover_le[where n = "Suc n"]) apply simp apply (frule range_cover_not_zero[rotated]) apply simp apply (frule range_cover.unat_of_nat_n) apply (subst upto_enum_red'[where X = "2 + of_nat n",simplified]) apply (simp add:field_simps word_le_sub1) apply clarsimp apply (subst upto_enum_red'[where X = "1 + of_nat n",simplified]) apply (simp add:field_simps word_le_sub1) apply simp done have conj_impI:
    "\<And>A B C. \<lbrakk>C;C\<Longrightarrow>B\<rbrakk> \<Longrightarrow> B \<and> C" by simp have suc_of_nat: "(1::word32) + of_nat n = of_nat (1 + n)" by simp have gsUserPages_update[simp]:
    "\<And>f. (\<lambda>ks. ks \<lparr>gsUserPages := f (gsUserPages ks)\<rparr>) = gsUserPages_update f" by (rule ext) simp have gsCNodes_update[simp]:
    "\<And>f. (\<lambda>ks. ks \<lparr>gsCNodes := f (gsCNodes ks)\<rparr>) = gsCNodes_update f" by (rule ext) simp have if_eq[simp]:
    "!!x a b pgsz. (if a = ptr + (1 + of_nat n << b) then Some pgsz
             else if a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> of_nat n}
                  then Just pgsz else x a) =
            (if a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + of_nat n}
             then Just pgsz else x a)" apply (simp only: Just_def if3_fold2) apply (rule_tac x="x a" in fun_cong) apply (rule arg_cong2[where f=If, OF _ refl]) apply (subgoal_tac "{x. x \<le> (1::word32) + of_nat n} =
                        {1 + of_nat n} \<union> {x. x \<le> of_nat n}") apply (simp add: add.commute) apply safe apply (clarsimp simp: word_le_less_eq[of _ "1 + of_nat n"]) apply (metis plus_one_helper add.commute) using cover apply - apply (drule range_cover_le[where n = "Suc n"], simp) apply (simp only: suc_of_nat word_le_nat_alt Suc_eq_plus1) apply (frule range_cover.unat_of_nat_n) apply simp apply (drule range_cover_le[where n=n], simp) apply (frule range_cover.unat_of_nat_n, simp) done show ?thesis using assms apply (clarsimp simp:valid_pspace'_def) apply (frule range_cover.aligned) apply (frule(3) pspace_no_overlap'_tail) apply simp apply (drule_tac ptr = "ptr + x" for x
         in pspace_no_overlap'_le[where sz' = "Types_H.getObjectSize ty us"]) apply (simp add:range_cover_def word_bits_def) apply (erule range_cover.sz(1)[where 'a=32, folded word_bits_def]) apply (simp add: createNewCaps_def) apply (case_tac ty) apply (simp add: ARM_H.toAPIType_def
                         Arch_createNewCaps_def) apply (rename_tac apiobject_type) apply (case_tac apiobject_type) apply (simp_all add: bind_assoc ARM_H.toAPIType_def
                                 )
            \<comment> \<open>Untyped\<close> apply (simp add:
              bind_assoc ARM_H.getObjectSize_def
              mapM_def sequence_def Retype_H.createObject_def
              ARM_H.toAPIType_def
              createObjects_def ARM_H.createObject_def
              Arch_createNewCaps_def comp_def
              apiGetObjectSize_def shiftl_t2n field_simps
              shiftL_nat mapM_x_def sequence_x_def append
              fromIntegral_def integral_inv[unfolded Fun.comp_def])
           \<comment> \<open>TCB, EP, NTFN\<close> apply (simp add: bind_assoc
                      ARM_H.getObjectSize_def
                      sequence_def Retype_H.createObject_def
                      ARM_H.toAPIType_def
                      createObjects_def ARM_H.createObject_def
                      Arch_createNewCaps_def comp_def
                      apiGetObjectSize_def shiftl_t2n field_simps
                      shiftL_nat append mapM_x_append2
                      fromIntegral_def integral_inv[unfolded Fun.comp_def])+ apply (subst monad_eq) apply (rule createObjects_Cons) apply (simp add: field_simps shiftl_t2n bind_assoc pageBits_def
                               objBits_simps placeNewObject_def2)+ apply (rule_tac Q = "\<lambda>r s. pspace_aligned' s \<and>
               pspace_distinct' s \<and>
               pspace_no_overlap' (ptr + (2^tcbBlockSizeBits + of_nat n * 2^tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and>
               range_cover (ptr + 2^tcbBlockSizeBits) sz
               (objBitsKO (KOTCB makeObject)) (Suc n)
               \<and> (\<forall>x\<in>set [0.e.of_nat n]. tcb_at' (ptr + x * 2^tcbBlockSizeBits) s)"
               in monad_eq_split2) apply simp apply (subst monad_commute_simple[symmetric]) apply (rule commute_commute[OF curDomain_commute]) apply (wpsimp+)[2] apply (rule_tac Q = "\<lambda>r s. r = (ksCurDomain s) \<and>
               pspace_aligned' s \<and>
               pspace_distinct' s \<and>
               pspace_no_overlap' (ptr + (2^tcbBlockSizeBits + of_nat n * 2^tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and>
               range_cover (ptr + 2^tcbBlockSizeBits) sz
               (objBitsKO (KOTCB makeObject)) (Suc n)
               \<and> (\<forall>x\<in>set [0.e.of_nat n]. tcb_at' (ptr + x * 2^tcbBlockSizeBits) s)
             " in  monad_eq_split) apply (subst monad_commute_simple[symmetric]) apply (rule createObjects_setDomains_commute) apply (clarsimp simp:objBits_simps) apply (rule conj_impI) apply (erule aligned_add_aligned) apply (rule aligned_add_aligned[where n = tcbBlockSizeBits]) apply (simp add:is_aligned_def objBits_defs) apply (cut_tac is_aligned_shift[where m = tcbBlockSizeBits and k = "of_nat n",
                     unfolded shiftl_t2n,simplified]) apply (simp add:field_simps)+ apply (erule range_cover_full) apply (simp add: word_bits_conv objBits_defs) apply (rule_tac Q = "\<lambda>x s. (ksCurDomain s) = ra" in monad_eq_split2) apply simp apply (rule_tac Q = "\<lambda>x s. (ksCurDomain s) = ra" in monad_eq_split) apply (subst rewrite_step[where f = curDomain and
                     P ="\<lambda>s. ksCurDomain s = ra" and f' = "return ra"]) apply (simp add:curDomain_def bind_def gets_def get_def) apply simp apply (simp add:mapM_x_singleton) apply wp apply simp apply (wp mapM_x_wp') apply simp apply (simp add:curDomain_def,wp) apply simp apply (wp createObjects'_psp_aligned[where sz = sz]
              createObjects'_psp_distinct[where sz = sz]) apply (rule hoare_vcg_conj_lift) apply (rule hoare_post_imp[OF _ createObjects'_pspace_no_overlap
                [unfolded shiftl_t2n,where gz = tcbBlockSizeBits and sz = sz,simplified]]) apply (simp add:objBits_simps field_simps) apply (simp add: objBits_simps) apply (wp createTCBs_tcb_at') apply (clarsimp simp:objBits_simps word_bits_def field_simps) apply (frule range_cover_le[where n = "Suc n"],simp+) apply (drule range_cover_offset[where p = 1,rotated]) apply simp apply (simp add: objBits_defs) apply (((simp add:
                      ARM_H.getObjectSize_def
                      mapM_def sequence_def Retype_H.createObject_def
                      ARM_H.toAPIType_def
                      createObjects_def ARM_H.createObject_def
                      Arch_createNewCaps_def comp_def
                      apiGetObjectSize_def shiftl_t2n field_simps
                      shiftL_nat mapM_x_def sequence_x_def append
                      fromIntegral_def integral_inv[unfolded Fun.comp_def])+
                   , subst monad_eq, rule createObjects_Cons
                   , (simp add: field_simps shiftl_t2n bind_assoc pageBits_def
                               objBits_simps' placeNewObject_def2)+)+)[2]
        \<comment> \<open>CNode\<close> apply (simp add: cteSizeBits_def pageBits_def tcbBlockSizeBits_def
                      epSizeBits_def ntfnSizeBits_def pdBits_def bind_assoc
                      ARM_H.getObjectSize_def
                      mapM_def sequence_def Retype_H.createObject_def
                      ARM_H.toAPIType_def
                      createObjects_def ARM_H.createObject_def
                      Arch_createNewCaps_def comp_def
                      apiGetObjectSize_def shiftl_t2n field_simps
                      shiftL_nat mapM_x_def sequence_x_def append
                      fromIntegral_def integral_inv[unfolded Fun.comp_def])+ apply (subst monad_eq, rule createObjects_Cons) apply (simp add: field_simps shiftl_t2n bind_assoc pageBits_def
                               objBits_simps' placeNewObject_def2)+ apply (subst gsCNodes_update gsCNodes_upd_createObjects'_comm)+ apply (simp add: modify_modify_bind) apply (rule fun_cong[where x=s]) apply (rule arg_cong_bind[OF refl ext])+ apply (rule arg_cong_bind[OF _ refl]) apply (rule arg_cong[where f=modify, OF ext], simp) apply (rule arg_cong2[where f=gsCNodes_update, OF ext refl]) apply (rule ext) apply simp

       \<comment> \<open>SmallPageObject\<close> apply (simp add: Arch_createNewCaps_def
                        Retype_H.createObject_def createObjects_def bind_assoc
                        ARM_H.toAPIType_def ARM_H.toAPIType_def
                        ARM_H.createObject_def placeNewDataObject_def) apply (intro conjI impI) apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                        getObjectSize_def ARM_H.getObjectSize_def
                        objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                         getObjectSize_def ARM_H.getObjectSize_def
                         pageBits_def add.commute append) apply ((subst gsUserPages_update gsCNodes_update
                    gsUserPages_upd_createObjects'_comm
                   | simp add: modify_modify_bind o_def)+)[1] apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                        getObjectSize_def ARM_H.getObjectSize_def
                        objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                         getObjectSize_def ARM_H.getObjectSize_def
                         pageBits_def add.commute append) apply (subst gsUserPages_update gsCNodes_update
                    gsUserPages_upd_createObjects'_comm
                   | simp add: modify_modify_bind o_def)+
      \<comment> \<open>LargePageObject\<close> apply (simp add: Arch_createNewCaps_def
                       Retype_H.createObject_def createObjects_def bind_assoc
                       ARM_H.toAPIType_def ARM_H.toAPIType_def
                       ARM_H.createObject_def placeNewDataObject_def) apply (intro conjI impI) apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                       getObjectSize_def ARM_H.getObjectSize_def
                       objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                        getObjectSize_def ARM_H.getObjectSize_def
                        pageBits_def add.commute append) apply ((subst gsUserPages_update gsCNodes_update
                   gsUserPages_upd_createObjects'_comm
                  | simp add: modify_modify_bind o_def)+)[1] apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                       ARM_H.getObjectSize_def objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                        ARM_H.getObjectSize_def
                       pageBits_def add.commute append) apply (subst gsUserPages_update gsCNodes_update
                   gsUserPages_upd_createObjects'_comm
             | simp add: modify_modify_bind o_def)+
     \<comment> \<open>SectionObject\<close> apply (simp add: Arch_createNewCaps_def
                      Retype_H.createObject_def createObjects_def bind_assoc
                      toAPIType_def ARM_H.toAPIType_def
                      ARM_H.createObject_def placeNewDataObject_def) apply (intro conjI impI) apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                      getObjectSize_def ARM_H.getObjectSize_def
                      objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                       getObjectSize_def ARM_H.getObjectSize_def
                       pageBits_def add.commute append) apply ((subst gsUserPages_update gsCNodes_update
                    gsUserPages_upd_createObjects'_comm
              | simp add: modify_modify_bind o_def)+)[1] apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                      ARM_H.getObjectSize_def objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                       ARM_H.getObjectSize_def
                      pageBits_def add.commute append) apply (subst gsUserPages_update gsCNodes_update
                  gsUserPages_upd_createObjects'_comm
            | simp add: modify_modify_bind o_def)+
    \<comment> \<open>SuperSectionObject\<close> apply (simp add: Arch_createNewCaps_def
                     Retype_H.createObject_def createObjects_def bind_assoc
                     toAPIType_def ARM_H.toAPIType_def
                     ARM_H.createObject_def placeNewDataObject_def) apply (intro conjI impI) apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                     getObjectSize_def ARM_H.getObjectSize_def
                     objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                      getObjectSize_def ARM_H.getObjectSize_def
                      pageBits_def add.commute append) apply ((subst gsUserPages_update gsCNodes_update
                 gsUserPages_upd_createObjects'_comm
               | simp add: modify_modify_bind o_def)+)[1] apply (subst monad_eq, rule createObjects_Cons) apply (simp_all add: field_simps shiftl_t2n pageBits_def
                     ARM_H.getObjectSize_def objBits_simps)[6] apply (simp add: bind_assoc placeNewObject_def2 objBits_simps
                      ARM_H.getObjectSize_def
                     pageBits_def add.commute append) apply (subst gsUserPages_update gsCNodes_update
                 gsUserPages_upd_createObjects'_comm
           | simp add: modify_modify_bind o_def)+
   \<comment> \<open>PageTableObject\<close> apply (simp add:Arch_createNewCaps_def Retype_H.createObject_def
           createObjects_def bind_assoc ARM_H.toAPIType_def
           ARM_H.createObject_def) apply (subst monad_eq,rule createObjects_Cons) apply ((simp add: field_simps shiftl_t2n pageBits_def archObjSize_def
               getObjectSize_def ARM_H.getObjectSize_def
               objBits_simps ptBits_def)+)[6] apply (simp add:bind_assoc placeNewObject_def2) apply (simp add: pageBits_def field_simps
               getObjectSize_def  ptBits_def archObjSize_def
               ARM_H.getObjectSize_def placeNewObject_def2
               objBits_simps append)

\<comment> \<open>PageDirectoryObject\<close> apply (simp add:Arch_createNewCaps_def Retype_H.createObject_def
           createObjects_def bind_assoc ARM_H.toAPIType_def
           ARM_H.createObject_def) apply (subgoal_tac "distinct (map (\<lambda>n. ptr + (n << 14)) [0.e.((of_nat n)::word32)])") prefer 2 apply (clarsimp simp: objBits_simps archObjSize_def pdBits_def pageBits_def
                                ARM_H.getObjectSize_def) apply (subst upto_enum_word) apply (clarsimp simp:distinct_map) apply (frule range_cover.range_cover_n_le) apply (frule range_cover.range_cover_n_less) apply (rule conjI) apply (clarsimp simp:inj_on_def) apply (rule ccontr) apply (erule_tac bnd = "2^(word_bits - 14)" in shift_distinct_helper[rotated 3]) apply simp apply (simp add:word_bits_def) apply (erule less_le_trans[OF word_of_nat_less]) apply (simp add: word_of_nat_le word_bits_def pdeBits_def) apply (erule less_le_trans[OF word_of_nat_less]) apply (simp add:word_of_nat_le word_bits_def pdeBits_def) apply (frule range_cover.unat_of_nat_n[OF range_cover_le[where n = n]]) apply simp apply (rule ccontr) apply simp apply (drule of_nat_inj32[THEN iffD1,rotated -1]) apply (simp_all add: word_bits_def)[3] apply (clarsimp) apply (erule_tac bnd = "2^(word_bits - 14)" in shift_distinct_helper[rotated 3]) apply simp apply (simp add:word_bits_def) apply (simp add:word_of_nat_less word_bits_def pdeBits_def) apply (erule less_le_trans[OF word_of_nat_less]) apply (simp add:word_of_nat_le word_bits_def pdeBits_def) apply (rule ccontr) apply (frule range_cover.unat_of_nat_n[OF range_cover_le[where n = n]]) apply simp apply simp apply (drule of_nat_inj32[THEN iffD1,rotated -1]) apply (simp_all add: word_bits_def)[3] apply (subst monad_eq,rule createObjects_Cons) apply ((simp add: field_simps shiftl_t2n pageBits_def archObjSize_def
                 ARM_H.getObjectSize_def pdBits_def
                 objBits_simps ptBits_def)+)[6] apply (simp add:objBits_simps archObjSize_def pdBits_def pageBits_def ARM_H.getObjectSize_def) apply (simp add:bind_assoc) apply (simp add: placeNewObject_def2[where val = "makeObject::ARM_H.pde",simplified,symmetric]) apply (rule_tac Q = "\<lambda>r s. valid_arch_state' s \<and>
           (\<forall>x\<le>of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> Q s" for Q in monad_eq_split) apply (rule sym) apply (subst bind_assoc[symmetric]) apply (subst monad_commute_simple) apply (rule commute_commute[OF monad_commute_split]) apply (rule placeNewObject_doMachineOp_commute) apply (rule mapM_x_commute[where f = id]) apply (rule placeNewObject_copyGlobalMapping_commute) apply (rule hoare_pre) apply (wp copyGlobalMappings_pspace_no_overlap' mapM_x_wp'| clarsimp simp: pdeBits_def)+ apply (clarsimp simp:objBits_simps archObjSize_def pdBits_def pageBits_def word_bits_conv) apply assumption  (* resolve assumption , yuck *)
            apply (simp add:append mapM_x_append bind_assoc pdeBits_def) apply (rule monad_eq_split[where Q = "\<lambda> r s.  pspace_aligned' s \<and> pspace_distinct' s
             \<and> valid_arch_state' s \<and> (\<forall>r \<le> of_nat n. page_directory_at' (ptr + (r << 14)) s)
             \<and>  page_directory_at' (ptr + ((1 + of_nat n) << 14)) s"]) apply (rule monad_eq_split[where Q = "\<lambda> r s.  pspace_aligned' s \<and> pspace_distinct' s
             \<and> valid_arch_state' s \<and> (\<forall>r \<le> of_nat n. page_directory_at' (ptr + (r << 14)) s)
             \<and>  page_directory_at' (ptr + ((1 + of_nat n) << 14)) s"]) apply (subst monad_commute_simple) apply (rule doMachineOp_copyGlobalMapping_commute) apply (clarsimp simp:field_simps) apply (simp add:field_simps mapM_x_singleton) apply (rule monad_eq_split[where Q = "\<lambda> r s.  pspace_aligned' s \<and> pspace_distinct' s
             \<and> valid_arch_state' s \<and> page_directory_at' (ptr + (1 + of_nat n << 14)) s"]) apply (subst doMachineOp_bind) apply (wp empty_fail_mapM_x empty_fail_cleanCacheRange_PoU)+ apply (simp add:bind_assoc objBits_simps field_simps archObjSize_def shiftL_nat) apply wp apply simp apply (rule mapM_x_wp') apply (rule hoare_pre) apply (wp copyGlobalMappings_pspace_no_overlap' | clarsimp)+ apply (clarsimp simp:page_directory_at'_def) apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift) apply ((clarsimp simp:page_directory_at'_def)+)[2] apply (wp placeNewObject_pspace_aligned' placeNewObject_pspace_distinct') apply (simp add:placeNewObject_def2 field_simps) apply (rule hoare_vcg_conj_lift) apply (rule createObjects'_wp_subst) apply (wp createObjects_valid_arch[where sz = 14]) apply (rule hoare_vcg_conj_lift) apply (clarsimp simp:page_directory_at'_def) apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift createObjects'_typ_at[where sz = 14]) apply (rule hoare_strengthen_post[OF createObjects'_page_directory_at'[where sz = 14]]) apply simp apply (clarsimp simp:objBits_simps page_directory_at'_def pdeBits_def
               field_simps archObjSize_def word_bits_conv range_cover_full
               aligned_add_aligned range_cover.aligned is_aligned_shiftl_self) apply (simp add: pdeBits_def) apply (frule pspace_no_overlap'_le2[where ptr' = "(ptr + (1 + of_nat n << 14))"]) apply (subst shiftl_t2n,subst mult.commute, subst suc_of_nat) apply (rule order_trans[OF range_cover_bound,where n1 = "1 + n"]) apply (erule range_cover_le,simp) apply simp apply (rule word_sub_1_le) apply (drule(1) range_cover_no_0[where p = "n+1"]) apply simp apply simp apply (erule(1) range_cover_tail_mask) apply (rule hoare_vcg_conj_lift) apply (rule createObjects'_wp_subst) apply (wp createObjects_valid_arch[where sz = sz]) apply (wp createObjects'_page_directory_at'[where sz = sz]
             createObjects'_psp_aligned[where sz = sz]
             createObjects'_psp_distinct[where sz = sz] hoare_vcg_imp_lift
             createObjects'_pspace_no_overlap[where sz = sz]
            | simp add:objBits_simps archObjSize_def field_simps pdeBits_def)+ apply (drule range_cover_le[where n = "Suc n"]) apply simp apply (clarsimp simp:word_bits_def valid_pspace'_def) apply (clarsimp simp:aligned_add_aligned[OF range_cover.aligned] is_aligned_shiftl_self word_bits_def)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (state)
goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
using this:
range_cover ptr sz (getObjectSize ty us) (Suc (Suc n))

goal (1 subgoal):
 1. [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)) \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (2 subgoals):
 1. range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)) \<Longrightarrow> Suc (Suc n) \<noteq> 0
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); word_of_nat (Suc (Suc n)) \<noteq> 0\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); word_of_nat (Suc (Suc n)) \<noteq> 0\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n)\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (2 subgoals):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n)\<rbrakk> \<Longrightarrow> Suc n \<le> Suc (Suc n)
 2. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n)\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n)\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (2 subgoals):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n)\<rbrakk> \<Longrightarrow> Suc n \<noteq> 0
 2. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0; unat (word_of_nat (Suc n)) = Suc n\<rbrakk> \<Longrightarrow> [0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (2 subgoals):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0; unat (word_of_nat (Suc n)) = Suc n\<rbrakk> \<Longrightarrow> 1 \<le> 2 + word_of_nat n
 2. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0; unat (word_of_nat (Suc n)) = Suc n\<rbrakk> \<Longrightarrow> map word_of_nat [0..<unat (2 + word_of_nat n)] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>word_of_nat (Suc (Suc n)) \<noteq> 0; unat (word_of_nat (Suc (Suc n))) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); word_of_nat (Suc n) \<noteq> 0; unat (word_of_nat (Suc n)) = Suc n\<rbrakk> \<Longrightarrow> map word_of_nat [0..<unat (2 + word_of_nat n)] = [0 .e. word_of_nat n] @ [1 + word_of_nat n] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>2 + word_of_nat n \<noteq> 0; unat (2 + word_of_nat n) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); 1 + word_of_nat n \<noteq> 0; unat (1 + word_of_nat n) = Suc n\<rbrakk> \<Longrightarrow> map word_of_nat [0..<n] @ [word_of_nat n] = [0 .e. word_of_nat n] proof (prove)
goal (2 subgoals):
 1. \<lbrakk>2 + word_of_nat n \<noteq> 0; unat (2 + word_of_nat n) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); 1 + word_of_nat n \<noteq> 0; unat (1 + word_of_nat n) = Suc n\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n
 2. \<lbrakk>2 + word_of_nat n \<noteq> 0; unat (2 + word_of_nat n) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); 1 + word_of_nat n \<noteq> 0; unat (1 + word_of_nat n) = Suc n\<rbrakk> \<Longrightarrow> map word_of_nat [0..<n] @ [word_of_nat n] = map word_of_nat [0..<unat (1 + word_of_nat n)] proof (prove)
goal (1 subgoal):
 1. \<lbrakk>2 + word_of_nat n \<noteq> 0; unat (2 + word_of_nat n) = Suc (Suc n); range_cover ptr sz (getObjectSize ty us) (Suc n); 1 + word_of_nat n \<noteq> 0; unat (1 + word_of_nat n) = Suc n\<rbrakk> \<Longrightarrow> map word_of_nat [0..<n] @ [word_of_nat n] = map word_of_nat [0..<unat (1 + word_of_nat n)] proof (prove)
goal:
No subgoals! proof (state)
this:
[0 .e. 1 + word_of_nat n] = [0 .e. word_of_nat n] @ [1 + word_of_nat n]

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<And>A B C. \<lbrakk>C; C \<Longrightarrow> B\<rbrakk> \<Longrightarrow> B \<and> C proof (state)
this:
\<lbrakk>?C; ?C \<Longrightarrow> ?B\<rbrakk> \<Longrightarrow> ?B \<and> ?C

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. 1 + word_of_nat n = word_of_nat (1 + n) proof (state)
this:
1 + word_of_nat n = word_of_nat (1 + n)

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<And>f. (\<lambda>ks. ks\<lparr>gsUserPages := f (gsUserPages ks)\<rparr>) = gsUserPages_update f proof (state)
this:
(\<lambda>ks. ks\<lparr>gsUserPages := ?f1 (gsUserPages ks)\<rparr>) = gsUserPages_update ?f1

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<And>f. (\<lambda>ks. ks\<lparr>gsCNodes := f (gsCNodes ks)\<rparr>) = gsCNodes_update f proof (state)
this:
(\<lambda>ks. ks\<lparr>gsCNodes := ?f2 (gsCNodes ks)\<rparr>) = gsCNodes_update ?f2

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz. (if a = ptr + (1 + word_of_nat n << b) then Some pgsz else if a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> word_of_nat n} then Just pgsz else x a) = (if a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + word_of_nat n} then Just pgsz else x a) proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz. (if a = ptr + (1 + word_of_nat n << b) \<or> a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> word_of_nat n} then Some pgsz else x a) = (if a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + word_of_nat n} then Some pgsz else x a) proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz. If (a = ptr + (1 + word_of_nat n << b) \<or> a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> word_of_nat n}) (Some pgsz) = If (a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + word_of_nat n}) (Some pgsz) proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz. (a = ptr + (1 + word_of_nat n << b) \<or> a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> word_of_nat n}) = (a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + word_of_nat n}) proof (prove)
goal (2 subgoals):
 1. \<And>x a b pgsz. {x. x \<le> 1 + word_of_nat n} = {1 + word_of_nat n} \<union> {x. x \<le> word_of_nat n} \<Longrightarrow> (a = ptr + (1 + word_of_nat n << b) \<or> a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> word_of_nat n}) = (a \<in> (\<lambda>n. ptr + (n << b)) ` {x. x \<le> 1 + word_of_nat n})
 2. \<And>x a b pgsz. {x. x \<le> 1 + word_of_nat n} = {1 + word_of_nat n} \<union> {x. x \<le> word_of_nat n} proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz. {x. x \<le> 1 + word_of_nat n} = {1 + word_of_nat n} \<union> {x. x \<le> word_of_nat n} proof (prove)
goal (2 subgoals):
 1. \<And>x a b pgsz xa. \<lbrakk>xa \<notin> {}; xa \<le> 1 + word_of_nat n; xa \<noteq> 1 + word_of_nat n\<rbrakk> \<Longrightarrow> xa \<le> word_of_nat n
 2. \<And>x a b pgsz xa. xa \<le> word_of_nat n \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
goal (2 subgoals):
 1. \<And>xa. \<lbrakk>xa < 1 + word_of_nat n; xa \<noteq> 1 + word_of_nat n\<rbrakk> \<Longrightarrow> xa \<le> word_of_nat n
 2. \<And>x a b pgsz xa. xa \<le> word_of_nat n \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz xa. xa \<le> word_of_nat n \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
using this:
range_cover ptr sz (getObjectSize ty us) (Suc (Suc n))

goal (1 subgoal):
 1. \<And>x a b pgsz xa. xa \<le> word_of_nat n \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz xa. \<lbrakk>xa \<le> word_of_nat n; range_cover ptr sz (getObjectSize ty us) (Suc (Suc n))\<rbrakk> \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz xa. \<lbrakk>xa \<le> word_of_nat n; range_cover ptr sz (getObjectSize ty us) (Suc n)\<rbrakk> \<Longrightarrow> xa \<le> 1 + word_of_nat n proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz xa. \<lbrakk>unat xa \<le> unat (word_of_nat n); range_cover ptr sz (getObjectSize ty us) (n + 1)\<rbrakk> \<Longrightarrow> unat xa \<le> unat (word_of_nat (1 + n)) proof (prove)
goal (1 subgoal):
 1. \<And>x a b pgsz xa. \<lbrakk>unat xa \<le> unat (word_of_nat n); range_cover ptr sz (getObjectSize ty us) (n + 1); unat (word_of_nat (n + 1)) = n + 1\<rbrakk> \<Longrightarrow> unat xa \<le> unat (word_of_nat (1 + n)) proof (prove)
goal (1 subgoal):
 1. \<And>xa. \<lbrakk>unat xa \<le> unat (word_of_nat n); range_cover ptr sz (getObjectSize ty us) (Suc n); unat (1 + word_of_nat n) = Suc n\<rbrakk> \<Longrightarrow> unat xa \<le> Suc n proof (prove)
goal (1 subgoal):
 1. \<And>xa. \<lbrakk>unat xa \<le> unat (word_of_nat n); unat (1 + word_of_nat n) = Suc n; range_cover ptr sz (getObjectSize ty us) n\<rbrakk> \<Longrightarrow> unat xa \<le> Suc n proof (prove)
goal:
No subgoals! proof (state)
this:
(if ?a3 = ptr + (1 + word_of_nat n << ?b3) then Some ?pgsz3 else if ?a3 \<in> (\<lambda>n. ptr + (n << ?b3)) ` {x. x \<le> word_of_nat n} then Just ?pgsz3 else ?x3 ?a3) = (if ?a3 \<in> (\<lambda>n. ptr + (n << ?b3)) ` {x. x \<le> 1 + word_of_nat n} then Just ?pgsz3 else ?x3 ?a3)

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
using this:
range_cover ptr sz (getObjectSize ty us) (Suc (Suc n))
valid_pspace' s
valid_arch_state' s
pspace_no_overlap' ptr sz s
ptr \<noteq> 0

goal (1 subgoal):
 1. createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us)\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us)\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) sz s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) sz s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us)\<rbrakk> \<Longrightarrow> getObjectSize ty us \<le> sz
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us)\<rbrakk> \<Longrightarrow> sz < word_bits
 3. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us)\<rbrakk> \<Longrightarrow> sz < word_bits
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s\<rbrakk> \<Longrightarrow> createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = APIObjectType x1\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType x1) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType x1) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType x1) us)) (getObjectSize (APIObjectType x1) us) s; ty = APIObjectType x1\<rbrakk> \<Longrightarrow> (case x1 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case x1 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType x1) ((1 + word_of_nat n << getObjectSize (APIObjectType x1) us) + ptr) us d;
return (x @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType apiobject_type) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType apiobject_type) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us)) (getObjectSize (APIObjectType apiobject_type) us) s; ty = APIObjectType apiobject_type; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject (APIObjectType apiobject_type) ((1 + word_of_nat n << getObjectSize (APIObjectType apiobject_type) us) + ptr) us d;
return (x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize ty us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize ty us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize ty us)) (getObjectSize ty us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc (Suc n)) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc (Suc n)) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) s = (do x <- case toAPIType ty of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty ptr (Suc n) us d;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral (Suc n) - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects ptr (Suc n) (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.Untyped) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.Untyped) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.Untyped) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.Untyped) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> return (map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ us) us 0) [0 .e. 1 + word_of_nat n]) s = (do r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.Untyped) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.Untyped) us) + ptr) us d;
return (map (\<lambda>n. capability.UntypedCap d (ptr + n * 2 ^ us) us 0) [0 .e. word_of_nat n] @ [r])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOTCB makeObject) 0;
xa <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. xa))) x;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.TCBObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) + ptr) us d;
return (map capability.ThreadCap x @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOTCB makeObject) 0;
xa <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. xa))) x;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.TCBObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) us) + ptr) us d;
return (map capability.ThreadCap x @ [r])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do y <- createObjects' ptr (Suc (Suc n)) (KOTCB makeObject) 0;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject))];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject)))])
od) s = (do y <- createObjects' ptr (Suc n) (KOTCB makeObject) 0;
x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
x <- placeNewObject (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) makeObject 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> createObjects' ptr (Suc (Suc n)) (KOTCB makeObject) 0 s = ?b26 apiobject_type s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do y <- ?b26 apiobject_type;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject))];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject)))])
od) s = (do y <- createObjects' ptr (Suc n) (KOTCB makeObject) 0;
x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
x <- placeNewObject (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) makeObject 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> range_cover ptr (?sz28 apiobject_type) (objBitsKO (KOTCB makeObject) + 0) (Suc (Suc n))
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (?sz28 apiobject_type) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do y <- do createObjects' ptr (Suc n) (KOTCB makeObject) 0;
createObjects' ((1 + word_of_nat n << objBitsKO (KOTCB makeObject) + 0) + ptr) (Suc 0) (KOTCB makeObject) 0
od;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject))];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ objBitsKO (KOTCB makeObject) + word_of_nat n * 2 ^ objBitsKO (KOTCB makeObject)))])
od) s = (do y <- createObjects' ptr (Suc n) (KOTCB makeObject) 0;
x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ objBitsKO (KOTCB makeObject)) [0 .e. word_of_nat n]);
x <- placeNewObject (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) makeObject 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ objBitsKO (KOTCB makeObject))) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
A total of 16 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOTCB makeObject) 0;
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) s = (do y <- createObjects' ptr (Suc n) (KOTCB makeObject) 0;
x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> createObjects' ptr (Suc n) (KOTCB makeObject) 0 s = createObjects' ptr (Suc n) (KOTCB makeObject) 0 s
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> (do y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa = (do x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> (do y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
curdom <- curDomain;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa = (do x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> monad_commute (?P41 apiobject_type r sa) curDomain (createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0)
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P41 apiobject_type r sa sa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> (do x <- curDomain;
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
xa <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa = (do x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type r sa P. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (ksCurDomain s)\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. P (ksCurDomain s)\<rbrace>
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> True
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> (do x <- curDomain;
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
xa <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa = (do x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> (do x <- curDomain;
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
xa <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa = (do x <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. x))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sa
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> monad_commute (?P57 apiobject_type r sa ra saa) (mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n])) (createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0)
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P57 apiobject_type r sa ra saa saa
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa \<and> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) (objBitsKO (KOTCB makeObject)) (Suc 0) \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject))
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits
 2. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> is_aligned (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits) tcbBlockSizeBits
 2. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 3. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 4. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> is_aligned (2 ^ tcbBlockSizeBits) tcbBlockSizeBits
 2. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat n * 2 ^ tcbBlockSizeBits) tcbBlockSizeBits
 3. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 4. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 5. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 6. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 8. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat n * 2 ^ tcbBlockSizeBits) tcbBlockSizeBits
 2. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 3. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 4. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 5. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (2 ^ tcbBlockSizeBits * word_of_nat n) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat n * 2 ^ tcbBlockSizeBits) tcbBlockSizeBits
 2. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 3. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits \<le> tcbBlockSizeBits
 4. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 5. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
A total of 18 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n; is_aligned (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits\<rbrakk> \<Longrightarrow> range_cover (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits tcbBlockSizeBits (Suc 0)
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>sa saa x. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa; pspace_aligned' saa; pspace_distinct' sa; pspace_distinct' saa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits sa; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits saa; \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa; range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n); \<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa; x \<le> word_of_nat n\<rbrakk> \<Longrightarrow> tcbBlockSizeBits < word_bits
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> (do x <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa = (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]);
x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) saa
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) saa = mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) saa
 2. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> (do y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sb = (do x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sb
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 4. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> (do y <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sb = (do x <- createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0;
x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sb
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc = (do x <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc
 2. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> \<lbrace>?P91 apiobject_type r sa ra saa rb sb\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 3. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ?P91 apiobject_type r sa ra saa rb sb sb
 4. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 5. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb rc sc sd. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra; ksCurDomain sd = ra\<rbrakk> \<Longrightarrow> curDomain sd = return ra sd
 2. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> ksCurDomain sc = ra
 3. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc = (do x <- return ra;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc
 4. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> \<lbrace>?P91 apiobject_type r sa ra saa rb sb\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 5. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ?P91 apiobject_type r sa ra saa rb sb sb
 6. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 7. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 8. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 9. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> ksCurDomain sc = ra
 2. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc = (do x <- return ra;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc
 3. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> \<lbrace>?P91 apiobject_type r sa ra saa rb sb\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 4. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ?P91 apiobject_type r sa ra saa rb sb sb
 5. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 6. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 8. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb rc sc. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra; ksCurDomain sc = ra\<rbrakk> \<Longrightarrow> (do y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) [ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)];
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc = (do x <- return ra;
y <- threadSet (tcbDomain_update (\<lambda>_. x)) (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits));
return (map (\<lambda>x. capability.ThreadCap (ptr + x * 2 ^ tcbBlockSizeBits)) [0 .e. word_of_nat n] @ [capability.ThreadCap (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits))])
od) sc
 2. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> \<lbrace>?P91 apiobject_type r sa ra saa rb sb\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 3. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ?P91 apiobject_type r sa ra saa rb sb sb
 4. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 5. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> \<lbrace>?P91 apiobject_type r sa ra saa rb sb\<rbrace> createObjects' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (Suc 0) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 2. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ?P91 apiobject_type r sa ra saa rb sb sb
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 4. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type r sa ra saa rb sb. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa); ksCurDomain sb = ra\<rbrakk> \<Longrightarrow> ksCurDomain sb = ra
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 3. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 10. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> \<lbrace>?P86 apiobject_type r sa ra saa\<rbrace> mapM_x (threadSet (tcbDomain_update (\<lambda>_. ra))) (map (\<lambda>n. ptr + n * 2 ^ tcbBlockSizeBits) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. ksCurDomain s = ra\<rbrace>
 2. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ?P86 apiobject_type r sa ra saa saa
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 9. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type r sa ra saa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa); ra = ksCurDomain saa \<and> pspace_aligned' saa \<and> pspace_distinct' saa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) saa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) saa)\<rbrakk> \<Longrightarrow> ksCurDomain saa = ra
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 8. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> \<lbrace>?P55 apiobject_type r sa\<rbrace> curDomain \<lbrace>\<lambda>r s. r = ksCurDomain s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 2. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ?P55 apiobject_type r sa sa
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type r sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)\<rbrakk> \<Longrightarrow> ksCurDomain sa = ksCurDomain sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa \<and> (\<forall>x\<le>word_of_nat n. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) sa)
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P35 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ?P35 apiobject_type s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'112 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv s. pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> ?P'112 apiobject_type s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P115 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv. pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject))\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'115 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv s. range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> ?P115 apiobject_type s \<and> ?P'115 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type rv sa. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_no_overlap' (ptr + 2 ^ tcbBlockSizeBits * (1 + word_of_nat n)) tcbBlockSizeBits sa\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) (objBitsKO (KOTCB makeObject)) sa
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> tcbBlockSizeBits = objBitsKO (KOTCB makeObject) + 0
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'115 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv s. range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_no_overlap' (ptr + 2 ^ tcbBlockSizeBits * (1 + word_of_nat n)) tcbBlockSizeBits and (\<lambda>y. range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)) \<and> ptr \<noteq> 0)) s \<and> ?P'115 apiobject_type s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> tcbBlockSizeBits = objBitsKO (KOTCB makeObject) + 0
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'115 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv s. range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_no_overlap' (ptr + 2 ^ tcbBlockSizeBits * (1 + word_of_nat n)) tcbBlockSizeBits and (\<lambda>y. range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)) \<and> ptr \<noteq> 0)) s \<and> ?P'115 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'115 apiobject_type\<rbrace> createObjects' ptr (Suc n) (KOTCB makeObject) 0 \<lbrace>\<lambda>rv s. range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> (\<forall>x\<in>set [0 .e. word_of_nat n]. tcb_at' (ptr + x * 2 ^ tcbBlockSizeBits) s)\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_no_overlap' (ptr + 2 ^ tcbBlockSizeBits * (1 + word_of_nat n)) tcbBlockSizeBits and (\<lambda>y. range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)) \<and> ptr \<noteq> 0)) s \<and> ?P'115 apiobject_type s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr sz and K (range_cover ptr sz (objBitsKO (KOTCB makeObject) + 0) (Suc n) \<and> Suc n \<noteq> 0 \<and> is_aligned ptr (objBitsKO (KOTCB makeObject) + 0) \<and> objBitsKO (KOTCB makeObject) + 0 < word_bits)) s \<and> (pspace_no_overlap' (ptr + 2 ^ tcbBlockSizeBits * (1 + word_of_nat n)) tcbBlockSizeBits and (\<lambda>y. range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)) \<and> ptr \<noteq> 0)) s \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz (objBitsKO (KOTCB makeObject)) (Suc n) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr (?sz126 apiobject_type) s \<and> range_cover ptr (?sz126 apiobject_type) (objBitsKO (KOTCB makeObject)) (Suc n)
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> range_cover ptr sz tcbBlockSizeBits (Suc n) \<and> tcbBlockSizeBits < Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))))))))))))))))))))))))) \<and> range_cover ptr sz tcbBlockSizeBits (Suc n) \<and> tcbBlockSizeBits < Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))))))))))))))))))))))))) \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n) \<and> pspace_no_overlap' ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) s \<and> range_cover ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) tcbBlockSizeBits (Suc n)
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz tcbBlockSizeBits (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; range_cover ptr sz tcbBlockSizeBits (Suc n)\<rbrakk> \<Longrightarrow> tcbBlockSizeBits < Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))))))))))))))))))))))))) \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n) \<and> pspace_no_overlap' ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) s \<and> range_cover ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) tcbBlockSizeBits (Suc n)
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (11 subgoals):
 1. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; range_cover ptr sz tcbBlockSizeBits (Suc n)\<rbrakk> \<Longrightarrow> 1 < Suc (Suc n)
 2. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; range_cover ptr sz tcbBlockSizeBits (Suc n); range_cover (ptr + word_of_nat 1 * 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc (Suc n) - 1)\<rbrakk> \<Longrightarrow> tcbBlockSizeBits < Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))))))))))))))))))))))))) \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n) \<and> pspace_no_overlap' ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) s \<and> range_cover ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) tcbBlockSizeBits (Suc n)
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr tcbBlockSizeBits; pspace_no_overlap' (ptr + (2 ^ tcbBlockSizeBits + word_of_nat n * 2 ^ tcbBlockSizeBits)) tcbBlockSizeBits s; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; range_cover ptr sz tcbBlockSizeBits (Suc n); range_cover (ptr + word_of_nat 1 * 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc (Suc n) - 1)\<rbrakk> \<Longrightarrow> tcbBlockSizeBits < Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc (Suc 0))))))))))))))))))))))))))))))) \<and> range_cover (ptr + 2 ^ tcbBlockSizeBits) sz tcbBlockSizeBits (Suc n) \<and> pspace_no_overlap' ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) s \<and> range_cover ptr (?sz126 ArchTypes_H.apiobject_type.TCBObject) tcbBlockSizeBits (Suc n)
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KOEndpoint makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs @ [r])
od) s
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od) s = (do addrs <- createObjects ptr (Suc n) (KONotification makeObject) 0;
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs @ [r])
od) s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us)) (getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do addrs <- createObjects ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od) s = (do x <- createObjects ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
r <- global.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) ((1 + word_of_nat n << getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) + ptr) us d;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do y <- createObjects' ptr (Suc (Suc n)) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr = ptr + (2 ^ (us + objBitsKO (KOCTE makeObject)) + word_of_nat n * 2 ^ (us + objBitsKO (KOCTE makeObject))) \<or> addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + objBitsKO (KOCTE makeObject)) + word_of_nat n * 2 ^ (us + objBitsKO (KOCTE makeObject)))) us 0 0])
od) s = (do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
x <- placeNewObject (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) makeObject us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else gsCNodes ks y\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> range_cover ptr (?sz162 apiobject_type) (objBitsKO (KOCTE makeObject) + us) (Suc (Suc n))
 2. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (?sz162 apiobject_type) s
 5. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do y <- do createObjects' ptr (Suc n) (KOCTE makeObject) us;
createObjects' ((1 + word_of_nat n << objBitsKO (KOCTE makeObject) + us) + ptr) (Suc 0) (KOCTE makeObject) us
od;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr = ptr + (2 ^ (us + objBitsKO (KOCTE makeObject)) + word_of_nat n * 2 ^ (us + objBitsKO (KOCTE makeObject))) \<or> addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + objBitsKO (KOCTE makeObject)) + word_of_nat n * 2 ^ (us + objBitsKO (KOCTE makeObject)))) us 0 0])
od) s = (do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
x <- placeNewObject (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) makeObject us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else gsCNodes ks y\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + objBitsKO (KOCTE makeObject))) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 13 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s = (do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else gsCNodes ks addr\<rparr>);
x <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else gsCNodes ks y\<rparr>);
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s = (do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
x <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
_ <- modify (gsCNodes_update (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s = (do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
x <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> gsCNodes_update (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> do x <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
y <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od = do y <- createObjects' ptr (Suc n) (KOCTE makeObject) us;
x <- createObjects' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (Suc 0) (KOCTE makeObject) us;
y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> gsCNodes_update (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type x xa. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> do y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od = do y <- modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> gsCNodes_update (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b));
return (map (\<lambda>x. capability.CNodeCap (ptr + x * 2 ^ (us + 4)) us 0 0) [0 .e. word_of_nat n] @ [capability.CNodeCap (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) us 0 0])
od
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type x xa. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b)) = modify (gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> gsCNodes_update (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type xb. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> gsCNodes_update (\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b) xb = gsCNodes_update ((\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b)) xb
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type xb x. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> a \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else x a) = ((\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b)) x
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type xb x xa. \<lbrakk>range_cover ptr sz (us + 4) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (us + 4); pspace_no_overlap' (ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4))) (us + 4) s; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if xa = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) \<or> xa \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else x xa) = ((\<lambda>a b. if b = ptr + (2 ^ (us + 4) + word_of_nat n * 2 ^ (us + 4)) then Some us else a b) \<circ> (\<lambda>a b. if b \<in> (\<lambda>x. ptr + x * 2 ^ (us + 4)) ` {x. x \<le> word_of_nat n} then Just us else a b)) x xa
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SmallPageObject ptr (Suc n) us d;
r <- global.createObject SmallPageObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject\<rbrakk> \<Longrightarrow> (d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s) \<and> (\<not> d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s)
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (13 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz229 (objBitsKO KOUserDataDevice + 0) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz229 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 0;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 0) + ptr) (Suc 0) KOUserDataDevice 0
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 13 subgoals... proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 0;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 0) + ptr) (Suc 0) KOUserDataDevice 0
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz 12 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 12; pspace_no_overlap' (ptr + (1 + word_of_nat n << 12)) 12 s; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
x <- createObjects' (ptr + (1 + word_of_nat n << 12)) (Suc 0) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 12)) VMReadWrite ARMSmallPage None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 12)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 12)) (Suc 0) KOUserDataDevice 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 12) then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 12)) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (12 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz243 (objBitsKO KOUserData + 0) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz243 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 0;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 0) + ptr) (Suc 0) KOUserData 0
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SmallPageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SmallPageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SmallPageObject us)) (getObjectSize SmallPageObject us) s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 0;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 0) + ptr) (Suc 0) KOUserData 0
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) UserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SmallPageObject us) + ptr) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz 12 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 12; pspace_no_overlap' (ptr + (1 + word_of_nat n << 12)) 12 s; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserData 0;
x <- createObjects' (ptr + (1 + word_of_nat n << 12)) (Suc 0) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 12)) VMReadWrite ARMSmallPage None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 12)) ` {x. x \<le> word_of_nat n} then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 12)) (Suc 0) KOUserData 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 12) then Some ARMSmallPage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSmallPage None) \<circ> (\<lambda>n. ptr + (n << 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 12)) VMReadWrite ARMSmallPage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps LargePageObject ptr (Suc n) us d;
r <- global.createObject LargePageObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject\<rbrakk> \<Longrightarrow> (d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s) \<and> (\<not> d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s)
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (12 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz270 (objBitsKO KOUserDataDevice + 4) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz270 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 4;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 4) + ptr) (Suc 0) KOUserDataDevice 4
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 4;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 4) + ptr) (Suc 0) KOUserDataDevice 4
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz 16 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 16; pspace_no_overlap' (ptr + (1 + word_of_nat n << 16)) 16 s; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
x <- createObjects' (ptr + (1 + word_of_nat n << 16)) (Suc 0) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 16)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << 16)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 16)) VMReadWrite ARMLargePage None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 16)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 16)) (Suc 0) KOUserDataDevice 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 16) then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << 16)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 16)) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (11 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz284 (objBitsKO KOUserData + 4) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz284 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 4;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 4) + ptr) (Suc 0) KOUserData 4
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize LargePageObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize LargePageObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize LargePageObject us)) (getObjectSize LargePageObject us) s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 4;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 4) + ptr) (Suc 0) KOUserData 4
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 4)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) UserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize LargePageObject us) + ptr then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 4)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize LargePageObject us) + ptr) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz 16 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 16; pspace_no_overlap' (ptr + (1 + word_of_nat n << 16)) 16 s; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserData 4;
x <- createObjects' (ptr + (1 + word_of_nat n << 16)) (Suc 0) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 16)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << 16)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 16)) VMReadWrite ARMLargePage None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 16)) ` {x. x \<le> word_of_nat n} then Just ARMLargePage else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 16)) (Suc 0) KOUserData 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 16) then Some ARMLargePage else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMLargePage None) \<circ> (\<lambda>n. ptr + (n << 16)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 16)) VMReadWrite ARMLargePage None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SectionObject ptr (Suc n) us d;
r <- global.createObject SectionObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject\<rbrakk> \<Longrightarrow> (d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s) \<and> (\<not> d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s)
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (11 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz311 (objBitsKO KOUserDataDevice + 8) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz311 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 8;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 8) + ptr) (Suc 0) KOUserDataDevice 8
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
A total of 11 subgoals... proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 8;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 8) + ptr) (Suc 0) KOUserDataDevice 8
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz 20 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 20; pspace_no_overlap' (ptr + (1 + word_of_nat n << 20)) 20 s; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
x <- createObjects' (ptr + (1 + word_of_nat n << 20)) (Suc 0) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 20)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << 20)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 20)) VMReadWrite ARMSection None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 20)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 20)) (Suc 0) KOUserDataDevice 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 20) then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << 20)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 20)) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz325 (objBitsKO KOUserData + 8) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz325 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 8;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 8) + ptr) (Suc 0) KOUserData 8
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SectionObject us)) (getObjectSize SectionObject us) s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 8;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 8) + ptr) (Suc 0) KOUserData 8
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 8)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) UserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SectionObject us) + ptr then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 8)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SectionObject us) + ptr) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 20 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 20; pspace_no_overlap' (ptr + (1 + word_of_nat n << 20)) 20 s; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserData 8;
x <- createObjects' (ptr + (1 + word_of_nat n << 20)) (Suc 0) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 20)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << 20)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 20)) VMReadWrite ARMSection None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 20)) ` {x. x \<le> word_of_nat n} then Just ARMSection else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 20)) (Suc 0) KOUserData 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 20) then Some ARMSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSection None) \<circ> (\<lambda>n. ptr + (n << 20)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 20)) VMReadWrite ARMSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps SuperSectionObject ptr (Suc n) us d;
r <- global.createObject SuperSectionObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> (d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s) \<and> (\<not> d \<longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s)
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz352 (objBitsKO KOUserDataDevice + 12) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz352 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 12;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 12) + ptr) (Suc 0) KOUserDataDevice 12
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 10. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserDataDevice 12;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserDataDevice + 12) + ptr) (Suc 0) KOUserDataDevice 12
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserDataDevice + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 24 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 24; pspace_no_overlap' (ptr + (1 + word_of_nat n << 24)) 24 s; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
x <- createObjects' (ptr + (1 + word_of_nat n << 24)) (Suc 0) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 24)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << 24)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 24)) VMReadWrite ARMSuperSection None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 24)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 24)) (Suc 0) KOUserDataDevice 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 24) then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap True n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << 24)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap True (ptr + (1 + word_of_nat n << 24)) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> range_cover ptr ?sz366 (objBitsKO KOUserData + 12) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz366 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 12;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 12) + ptr) (Suc 0) KOUserData 12
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 9. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize SuperSectionObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize SuperSectionObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize SuperSectionObject us)) (getObjectSize SuperSectionObject us) s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) KOUserData 12;
createObjects' ((1 + word_of_nat n << objBitsKO KOUserData + 12) + ptr) (Suc 0) KOUserData 12
od;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << objBitsKO KOUserData + 12)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- placeNewObject ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) UserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = (1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << objBitsKO KOUserData + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False ((1 + word_of_nat n << getObjectSize SuperSectionObject us) + ptr) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz 24 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 24; pspace_no_overlap' (ptr + (1 + word_of_nat n << 24)) 24 s; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) KOUserData 12;
x <- createObjects' (ptr + (1 + word_of_nat n << 24)) (Suc 0) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 24)) ` {x. x \<le> 1 + word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << 24)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 24)) VMReadWrite ARMSuperSection None)])
od) s = (do x <- createObjects' ptr (Suc n) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> (\<lambda>x. ptr + (x << 24)) ` {x. x \<le> word_of_nat n} then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
x <- createObjects' (ptr + (1 + word_of_nat n << 24)) (Suc 0) KOUserData 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = ptr + (1 + word_of_nat n << 24) then Some ARMSuperSection else gsUserPages ks y\<rparr>);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>n. arch_capability.PageCap False n VMReadWrite ARMSuperSection None) \<circ> (\<lambda>n. ptr + (n << 24)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageCap False (ptr + (1 + word_of_nat n << 24)) VMReadWrite ARMSuperSection None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageTableObject ptr (Suc n) us d;
r <- global.createObject PageTableObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do y <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do y <- createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
y <- placeNewObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) makeObject (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageTableCap ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> range_cover ptr ?sz386 (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz386 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do y <- do createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
createObjects' ((1 + word_of_nat n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) + ptr) (Suc 0) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject)
od;
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do y <- createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
y <- placeNewObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) makeObject (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageTableCap ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) None)])
od) s
 8. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do y <- do createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
createObjects' ((1 + word_of_nat n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) + ptr) (Suc 0) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject)
od;
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do y <- createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
y <- placeNewObject ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) makeObject (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageTableCap ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageTableObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageTableObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageTableObject us)) (getObjectSize PageTableObject us) s; ty = PageTableObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
y <- createObjects' ((1 + word_of_nat n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) + ptr) (Suc 0) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do y <- createObjects' ptr (Suc n) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
y <- createObjects' ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) (Suc 0) (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageTableCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageTableCap ((1 + word_of_nat n << getObjectSize PageTableObject us) + ptr) None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc (Suc n)) us d;
return (map capability.ArchObjectCap archCaps)
od) s = (do archCaps <- Arch_createNewCaps PageDirectoryObject ptr (Suc n) us d;
r <- global.createObject PageDirectoryObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) us d;
return (map capability.ArchObjectCap archCaps @ [r])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> distinct (map (\<lambda>n. ptr + (n << 14)) (map word_of_nat [unat 0..<Suc (unat (word_of_nat n))]))
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> inj_on ((\<lambda>n. ptr + (n << 14)) \<circ> word_of_nat) {0..<unat (word_of_nat n)} \<and> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits))\<rbrakk> \<Longrightarrow> inj_on ((\<lambda>n. ptr + (n << 14)) \<circ> word_of_nat) {0..<unat (word_of_nat n)} \<and> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> inj_on ((\<lambda>n. ptr + (n << 14)) \<circ> word_of_nat) {0..<unat (word_of_nat n)} \<and> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> inj_on ((\<lambda>n. ptr + (n << 14)) \<circ> word_of_nat) {0..<unat (word_of_nat n)}
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); word_of_nat x << 14 = word_of_nat y << 14\<rbrakk> \<Longrightarrow> x = y
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); word_of_nat x << 14 = word_of_nat y << 14; x \<noteq> y\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - 14) - 1 \<le> 2 ^ (LENGTH(32) - 14) - 1
 3. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 4. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat y < 2 ^ (word_bits - 14)
 5. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (6 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - 14) - 1 \<le> 2 ^ (LENGTH(32) - 14) - 1
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 3. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat y < 2 ^ (word_bits - 14)
 4. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (5 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat y < 2 ^ (word_bits - 14)
 3. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (5 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat n \<le> 2 ^ (word_bits - 14)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat y < 2 ^ (word_bits - 14)
 3. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (4 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat y < 2 ^ (word_bits - 14)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (4 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat n \<le> 2 ^ (word_bits - 14)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (4 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y\<rbrakk> \<Longrightarrow> n \<le> Suc (Suc n)
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> word_of_nat y
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); y < unat (word_of_nat n); x \<noteq> y; unat (word_of_nat n) = n; \<not> word_of_nat x \<noteq> word_of_nat y\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; y < n; x \<noteq> y; unat (word_of_nat n) = n; word_of_nat x = word_of_nat y\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (5 subgoals):
 1. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; y < n; x \<noteq> y; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> x < 2 ^ word_bits
 2. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; y < n; x \<noteq> y; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> y < 2 ^ word_bits
 3. \<And>x y. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; y < n; x \<noteq> y; unat (word_of_nat n) = n; x = y\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (LENGTH(32) - (12 + pdeBits)); Suc (Suc n) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> ptr + (word_of_nat n << 14) \<notin> (\<lambda>x. ptr + (word_of_nat x << 14)) ` {0..<unat (word_of_nat n)}
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; word_of_nat n << 14 = word_of_nat x << 14; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - 14) - 1 \<le> 2 ^ (LENGTH(32) - 14) - 1
 3. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (word_bits - 14)
 4. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 5. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> 2 ^ (word_bits - 14) - 1 \<le> 2 ^ (LENGTH(32) - 14) - 1
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (word_bits - 14)
 3. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 4. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (word_bits - 14)
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 3. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 14)
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294\<rbrakk> \<Longrightarrow> word_of_nat n \<le> 2 ^ (word_bits - 14)
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n)\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> word_of_nat x
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); \<not> word_of_nat n \<noteq> word_of_nat x\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); \<not> word_of_nat n \<noteq> word_of_nat x\<rbrakk> \<Longrightarrow> n \<le> Suc (Suc n)
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); \<not> word_of_nat n \<noteq> word_of_nat x; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> False
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < unat (word_of_nat n); \<not> word_of_nat n \<noteq> word_of_nat x; unat (word_of_nat n) = n\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat x << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; word_of_nat n = word_of_nat x; unat (word_of_nat x) = n\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat x << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; unat (word_of_nat x) = n\<rbrakk> \<Longrightarrow> n < 2 ^ word_bits
 2. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat x << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; unat (word_of_nat x) = n\<rbrakk> \<Longrightarrow> x < 2 ^ word_bits
 3. \<And>x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat x << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; Suc (Suc n) \<le> 2 ^ (20 - pdeBits); n < 4294967294; x < n; unat (word_of_nat x) = n; n = x\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc (Suc n)) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> range_cover ptr ?sz462 (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) (Suc (Suc n))
 2. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr ?sz462 s
 5. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> pspace_aligned' s
 6. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 7. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
createObjects' ((1 + word_of_nat n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) + ptr) (Suc 0) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject)
od;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (getObjectSize PageDirectoryObject us) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (getObjectSize PageDirectoryObject us); pspace_no_overlap' (ptr + (1 + word_of_nat n << getObjectSize PageDirectoryObject us)) (getObjectSize PageDirectoryObject us) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- do createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
createObjects' ((1 + word_of_nat n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) + ptr) (Suc 0) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject)
od;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) makeObject (pdBits - objBits makeObject);
x <- copyGlobalMappings ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr + 2 ^ pdBits - 1) (addrFromPPtr ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject))))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << getObjectSize PageDirectoryObject us) + ptr) None)])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- do a <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
createObjects' ((1 + word_of_nat n << pdeBits + 12) + ptr) (Suc 0) (KOArch (KOPDE makeObject)) 12
od;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
x <- createObjects' ((1 + word_of_nat n << pdeBits + 12) + ptr) (Suc 0) (KOArch (KOPDE makeObject)) 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) s = (do x <- createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa = (do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]));
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> monad_commute (?P485 r sa) (do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od) (placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12)
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> ?P485 r sa sa
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>r sa ra. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> monad_commute (?Q488 r sa ra) (placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12) (doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n])))
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> monad_commute (?P488 r sa) (placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12) (mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'488 r sa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]) \<lbrace>?Q488 r sa\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (?P488 r sa and ?P'488 r sa) sa
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> monad_commute (?P488 r sa) (placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12) (mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'488 r sa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r. K (12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (?P488 r sa and ?P'488 r sa) sa
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>r sa ra. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> monad_commute (?P493 r sa ra) (placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12) (copyGlobalMappings ra)
 2. \<And>r sa ra x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P493 r sa ra and K (id ra \<noteq> id x) and ?P493 r sa x\<rbrace> copyGlobalMappings x \<lbrace>\<lambda>v. ?P493 r sa ra\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'488 r sa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r. K (12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. distinct (map id (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n])) \<and> (\<forall>ra\<in>set (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]). ?P493 r sa ra s)) and ?P'488 r sa) sa
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<And>r sa ra x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' ra and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)) and K (id ra \<noteq> id x) and (valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' x and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)))\<rbrace> copyGlobalMappings x \<lbrace>\<lambda>v. valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' ra and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12))\<rbrace>
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'488 r sa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r. K (12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. distinct (map id (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n])) \<and> (\<forall>r\<in>set (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]). (valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' r and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12))) s)) and ?P'488 r sa) sa
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>r sa ra x. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 r sa ra x\<rbrace> copyGlobalMappings x \<lbrace>\<lambda>v. valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' ra and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12))\<rbrace>
 2. \<And>r sa ra x saa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa; (valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' ra and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)) and K (id ra \<noteq> id x) and (valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' x and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)))) saa\<rbrakk> \<Longrightarrow> ?Q497 r sa ra x saa
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'488 r sa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r. K (12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12)\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. distinct (map id (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n])) \<and> (\<forall>r\<in>set (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]). (valid_arch_state' and pspace_distinct' and pspace_aligned' and page_directory_at' r and pspace_no_overlap' ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12) and K (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 12 + pdeBits) + ptr) (objBitsKO (injectKOS makeObject) + 12))) s)) and ?P'488 r sa) sa
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?Q478 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?Q478 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa; \<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa; ?P648 sa; ?Q649 sa\<rbrakk> \<Longrightarrow> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (KOArch (KOPDE makeObject)) + 12) sa \<and> objBitsKO (KOArch (KOPDE makeObject)) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (KOArch (KOPDE makeObject)) + 12)) \<and> 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (KOArch (KOPDE makeObject)) + 12) \<and> objBitsKO (KOArch (KOPDE makeObject)) + 12 < word_bits \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (KOArch (KOPDE makeObject)) + 12) sa
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?P648 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?P648 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa; \<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa; ?P648 sa; ?Q649 sa\<rbrakk> \<Longrightarrow> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ?P648 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ?P648 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa) \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) sa) \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 12 + pdeBits) + ptr) makeObject 12;
x <- do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]);
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. word_of_nat n]))
od;
x <- copyGlobalMappings ((1 + word_of_nat n << 12 + pdeBits) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 12 + pdeBits) + ptr) ((1 + word_of_nat n << 12 + pdeBits) + ptr + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr ((1 + word_of_nat n << 12 + pdeBits) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 12 + pdeBits) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << pdeBits + 12) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]);
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) (12 + pdeBits)) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << pdeBits + 12)) [0 .e. 1 + word_of_nat n]));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << pdeBits + 12)))) [0 .e. 1 + word_of_nat n])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (do y <- placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
x <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) sa = (do x <- placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12;
x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> (do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
x <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) saa = (do x <- mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) saa
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (do x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
x <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) sb = (do x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (9 subgoals):
 1. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> monad_commute (?P681 sa r saa ra sb) (doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]))) (copyGlobalMappings ((1 + word_of_nat n << 14) + ptr))
 2. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?P681 sa r saa ra sb sb
 3. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (do y <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) sb = (do x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb
 4. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 6. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 8. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 9. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (8 subgoals):
 1. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (valid_arch_state' and page_directory_at' ((1 + word_of_nat n << 14) + ptr)) sb
 2. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (do y <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) sb = (do x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 4. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 8. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa r saa ra sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (do y <- copyGlobalMappings ((1 + word_of_nat n << 14) + ptr);
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU ((1 + word_of_nat n << 14) + ptr) (0x3FFF + ((1 + word_of_nat n << 14) + ptr)) (addrFromPPtr ((1 + word_of_nat n << 14) + ptr)));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap ((1 + word_of_nat n << 14) + ptr) None)])
od) sb = (do x <- mapM_x copyGlobalMappings [ptr + (1 + word_of_nat n << 14)];
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) [ptr + (1 + word_of_nat n << 14)]
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> (do y <- copyGlobalMappings (ptr + (1 + word_of_nat n << 14));
x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + ((1 + word_of_nat n << 14) + 0x3FFF)) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb = (do x <- copyGlobalMappings (ptr + (1 + word_of_nat n << 14));
y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + (word_of_nat (shiftL (Suc 0) 14) + (1 + word_of_nat n << 14)) - 1) (addrFromPPtr (ptr + (1 + word_of_nat n << 14)))
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sb
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (9 subgoals):
 1. \<And>sa saa sb r sc. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb; pspace_aligned' sc \<and> pspace_distinct' sc \<and> valid_arch_state' sc \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sc\<rbrakk> \<Longrightarrow> (do x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + ((1 + word_of_nat n << 14) + 0x3FFF)) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc = (do y <- doMachineOp (do x <- mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]);
cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + (word_of_nat (shiftL (Suc 0) 14) + (1 + word_of_nat n << 14)) - 1) (addrFromPPtr (ptr + (1 + word_of_nat n << 14)))
od);
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc
 2. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> \<lbrace>?P684 sa saa sb\<rbrace> copyGlobalMappings (ptr + (1 + word_of_nat n << 14)) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?P684 sa saa sb sb
 4. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 6. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 8. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 9. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (11 subgoals):
 1. \<And>sa saa sb r sc. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb; pspace_aligned' sc \<and> pspace_distinct' sc \<and> valid_arch_state' sc \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sc\<rbrakk> \<Longrightarrow> empty_fail (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]))
 2. \<And>sa saa sb r sc x. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb; pspace_aligned' sc \<and> pspace_distinct' sc \<and> valid_arch_state' sc \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sc\<rbrakk> \<Longrightarrow> empty_fail (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + (word_of_nat (shiftL (Suc 0) 14) + (1 + word_of_nat n << 14)) - 1) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))))
 3. \<And>sa saa sb r sc. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb; pspace_aligned' sc \<and> pspace_distinct' sc \<and> valid_arch_state' sc \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sc\<rbrakk> \<Longrightarrow> (do x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + ((1 + word_of_nat n << 14) + 0x3FFF)) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc = (do y <- do rv <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + (word_of_nat (shiftL (Suc 0) 14) + (1 + word_of_nat n << 14)) - 1) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))))
od;
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc
 4. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> \<lbrace>?P684 sa saa sb\<rbrace> copyGlobalMappings (ptr + (1 + word_of_nat n << 14)) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?P684 sa saa sb sb
 6. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 7. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 8. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 9. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 10. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>sa saa sb r sc. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb; pspace_aligned' sc \<and> pspace_distinct' sc \<and> valid_arch_state' sc \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sc\<rbrakk> \<Longrightarrow> (do x <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
y <- doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + ((1 + word_of_nat n << 14) + 0x3FFF)) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))));
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc = (do y <- do rv <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) 14) - 1) (addrFromPPtr x)) (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]));
doMachineOp (cleanCacheRange_PoU (ptr + (1 + word_of_nat n << 14)) (ptr + (word_of_nat (shiftL (Suc 0) 14) + (1 + word_of_nat n << 14)) - 1) (addrFromPPtr (ptr + (1 + word_of_nat n << 14))))
od;
return (map (capability.ArchObjectCap \<circ> ((\<lambda>pt. arch_capability.PageDirectoryCap pt None) \<circ> (\<lambda>n. ptr + (n << 14)))) [0 .e. word_of_nat n] @ [capability.ArchObjectCap (arch_capability.PageDirectoryCap (ptr + (1 + word_of_nat n << 14)) None)])
od) sc
 2. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> \<lbrace>?P684 sa saa sb\<rbrace> copyGlobalMappings (ptr + (1 + word_of_nat n << 14)) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?P684 sa saa sb sb
 4. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 6. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 7. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 8. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 9. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (8 subgoals):
 1. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> \<lbrace>?P684 sa saa sb\<rbrace> copyGlobalMappings (ptr + (1 + word_of_nat n << 14)) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?P684 sa saa sb sb
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 4. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 6. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 8. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa saa sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P676 sa r saa\<rbrace> mapM_x copyGlobalMappings (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]) \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> ?P676 sa r saa saa
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<And>sa r saa x. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace> copyGlobalMappings x \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa r saa x. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?Q709 sa r saa x\<rbrace> copyGlobalMappings x \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa r saa x sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> ?Q709 sa r saa x sb
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa saa xa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); xa \<le> word_of_nat n; valid_arch_state' sa; pspace_aligned' saa; \<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa; pspace_distinct' saa; valid_arch_state' saa; is_aligned ((1 + word_of_nat n << 14) + ptr) 14; \<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa; page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; pspace_aligned' sa; pspace_distinct' sa; pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa; ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'717 sa () saa (ptr + (xa << 14))\<rbrace> copyGlobalMappings (ptr + (xa << 14)) \<lbrace>\<lambda>rv s. (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa r saa x sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> ?P'717 sa r saa x sb
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (7 subgoals):
 1. \<And>sa saa xa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); xa \<le> word_of_nat n; valid_arch_state' sa; pspace_aligned' saa; \<forall>x\<le>word_of_nat n. is_aligned (ptr + (x << 14)) pdBits \<and> (\<forall>y<0x1000. pde_at' (ptr + (x << 14) + (y << 2)) sa); pspace_distinct' saa; valid_arch_state' saa; is_aligned ((1 + word_of_nat n << 14) + ptr) 14; \<forall>r\<le>word_of_nat n. \<forall>y<0x1000. pde_at' (ptr + (r << 14) + (y << 2)) saa; pspace_aligned' sa; pspace_distinct' sa; pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa; ?Q649 sa; is_aligned (ptr + (1 + word_of_nat n << 14)) pdBits; \<forall>y<0x1000. pde_at' (ptr + (1 + word_of_nat n << 14) + (y << 2)) saa\<rbrakk> \<Longrightarrow> \<lbrace>?P'717 sa () saa (ptr + (xa << 14))\<rbrace> copyGlobalMappings (ptr + (xa << 14)) \<lbrace>\<lambda>rv s. (\<forall>r\<le>word_of_nat n. \<forall>y<0x1000. pde_at' (ptr + (r << 14) + (y << 2)) s) \<and> (\<forall>y<0x1000. pde_at' (ptr + (1 + word_of_nat n << 14) + (y << 2)) s)\<rbrace>
 2. \<And>sa r saa x sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> ?P'717 sa r saa x sb
 3. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 5. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<And>sa r saa x sb. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa; x \<in> set (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) sb) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) sb\<rbrakk> \<Longrightarrow> pspace_aligned' sb \<and> pspace_distinct' sb \<and> valid_arch_state' sb \<and> (\<forall>x. \<not> x \<le> word_of_nat n \<or> (\<forall>xa. \<not> xa < 0x1000 \<or> pde_at' (ptr + (x << 14) + (xa << 2)) sb)) \<and> (\<forall>x. \<not> x < 0x1000 \<or> pde_at' (ptr + (1 + word_of_nat n << 14) + (x << 2)) sb)
 2. \<And>sa r saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa; pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa\<rbrakk> \<Longrightarrow> pspace_aligned' saa \<and> pspace_distinct' saa \<and> valid_arch_state' saa \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) saa) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 4. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P672 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>r s. pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> ?P672 sa sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'786 sa\<rbrace> placeNewObject ((1 + word_of_nat n << 14) + ptr) makeObject 12 \<lbrace>\<lambda>rv s. valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> ?P'786 sa sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'786 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. valid_arch_state' s \<and> (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> ?P'786 sa sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P790 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'790 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> ?P790 sa sa \<and> ?P'790 sa sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P790 sa\<rbrace> createObjects (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'790 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> ?P790 sa sa \<and> ?P'790 sa sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'790 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s) \<and> page_directory_at' (ptr + (1 + word_of_nat n << 14)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> ?P'790 sa sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P798 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. \<forall>r\<le>word_of_nat n. page_directory_at' (ptr + (r << 14)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'798 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. page_directory_at' (ptr + (1 + word_of_nat n << 14))\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> ?P798 sa sa \<and> ?P'798 sa sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa; \<forall>x\<le>word_of_nat n. is_aligned (ptr + (x << 14)) pdBits \<and> (\<forall>y<0x1000. pde_at' (ptr + (x << 14) + (y << 2)) sa); is_aligned (ptr + (1 + word_of_nat n << 14)) 14; pspace_aligned' sa; pspace_distinct' sa; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa; ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P798 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. \<forall>r\<le>word_of_nat n. \<forall>y<0x1000. pde_at' (ptr + (r << 14) + (y << 2)) s\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'798 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. page_directory_at' (ptr + (1 + word_of_nat n << 14))\<rbrace>
 3. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> ?P798 sa sa \<and> ?P'798 sa sa
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> \<lbrace>?P'798 sa\<rbrace> createObjects' (ptr + (1 + word_of_nat n << 14)) (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. page_directory_at' (ptr + (1 + word_of_nat n << 14))\<rbrace>
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> (\<forall>x. \<not> x \<le> word_of_nat n \<or> (\<forall>xa. \<not> xa < 0x1000 \<or> Suc 0 \<noteq> 0 \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pde_at' (ptr + (x << 14) + (xa << 2)) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa)) \<and> ?P'798 sa sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<And>sa rv saa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> ?Q649 sa; \<forall>x\<le>word_of_nat 0. page_directory_at' (ptr + (1 + word_of_nat n << 14) + (x << 14)) saa\<rbrakk> \<Longrightarrow> page_directory_at' (ptr + (1 + word_of_nat n << 14)) saa
 2. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> (\<forall>x. \<not> x \<le> word_of_nat n \<or> (\<forall>xa. \<not> xa < 0x1000 \<or> Suc 0 \<noteq> 0 \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pde_at' (ptr + (x << 14) + (xa << 2)) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa)) \<and> (K (range_cover (ptr + (1 + word_of_nat n << 14)) 14 14 (Suc 0)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14) sa
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); valid_arch_state' sa \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) sa) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' sa \<and> pspace_aligned' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 sa \<and> ?Q649 sa\<rbrakk> \<Longrightarrow> (K (is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> objBitsKO (injectKOS makeObject) + 12 < word_bits) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12)) sa \<and> (objBitsKO (injectKOS makeObject) + 12 < word_bits \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (objBitsKO (injectKOS makeObject) + 12) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa) \<and> (valid_arch_state' sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0) \<and> (\<forall>x. \<not> x \<le> word_of_nat n \<or> (\<forall>xa. \<not> xa < 0x1000 \<or> Suc 0 \<noteq> 0 \<and> range_cover (ptr + (1 + word_of_nat n << 14)) 14 (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pde_at' (ptr + (x << 14) + (xa << 2)) sa \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 sa)) \<and> (K (range_cover (ptr + (1 + word_of_nat n << 14)) 14 14 (Suc 0)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14) sa
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> (((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s \<and> pdeBits < 20 \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12)) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) \<and> pdeBits < 20 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) (pdeBits + 12) s) \<and> ?Q649 s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (1 + word_of_nat n << 14)
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr \<le> ptr + word_of_nat (1 + n) * 2 ^ 14
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> range_cover ptr ?sz857 ?us857 (1 + n)
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> 0 < 1 + n
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ ?us857 - 1 \<le> ptr + word_of_nat (1 + n) * 2 ^ 14
 4. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 5. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> 0 < 1 + n
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ 14 - 1 \<le> ptr + word_of_nat (1 + n) * 2 ^ 14
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 4. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ 14 - 1 \<le> ptr + word_of_nat (1 + n) * 2 ^ 14
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ 14 \<noteq> 0
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> n + 1 < Suc (Suc n)
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); ptr + word_of_nat (n + 1) * 2 ^ 14 \<noteq> 0\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ 14 \<noteq> 0
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 4. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); ptr + word_of_nat (n + 1) * 2 ^ 14 \<noteq> 0\<rbrakk> \<Longrightarrow> ptr + word_of_nat (1 + n) * 2 ^ 14 \<noteq> 0
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 3. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ptr + (1 + word_of_nat n << 14) && ~~ mask sz = ptr && ~~ mask sz
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P471\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>r s. valid_arch_state' s \<and> (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P471 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P871\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P'871\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P871 s \<and> ?P'871 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P871\<rbrace> createObjects ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 2. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P'871\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> ?P871 s \<and> ?P'871 s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) sz s\<rbrakk> \<Longrightarrow> \<lbrace>?P'871\<rbrace> createObjects' ptr (Suc n) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>rv s. (\<forall>x\<le>word_of_nat n. page_directory_at' (ptr + (x << 14)) s) \<and> ((\<exists>r. r \<le> word_of_nat n) \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14) \<and> is_aligned ((1 + word_of_nat n << 14) + ptr) 14 \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ((1 + word_of_nat n << 14) + ptr) 14 s \<and> ?Q649 s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (12 + pdeBits) (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr (12 + pdeBits); pspace_no_overlap' (ptr + (1 + word_of_nat n << 12 + pdeBits)) (12 + pdeBits) s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> (valid_arch_state' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> range_cover ptr sz (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc n) \<and> Suc n \<noteq> 0) \<and> ?P'871 s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz 14 (Suc (Suc n)); valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> range_cover ptr sz 14 (Suc n) \<and> ((\<forall>r. \<not> r \<le> word_of_nat n) \<or> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n])\<rbrakk> \<Longrightarrow> Suc n \<le> Suc (Suc n)
 2. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); range_cover ptr sz 14 (Suc n)\<rbrakk> \<Longrightarrow> range_cover ptr sz 14 (Suc n) \<and> ((\<forall>r. \<not> r \<le> word_of_nat n) \<or> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); range_cover ptr sz 14 (Suc n)\<rbrakk> \<Longrightarrow> range_cover ptr sz 14 (Suc n) \<and> ((\<forall>r. \<not> r \<le> word_of_nat n) \<or> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 \<and> range_cover ptr sz 14 (Suc n) \<and> 14 < word_bits proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_arch_state' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; is_aligned ptr 14; pspace_no_overlap' (ptr + (1 + word_of_nat n << 14)) 14 s; ty = PageDirectoryObject; distinct (map (\<lambda>n. ptr + (n << 14)) [0 .e. word_of_nat n]); range_cover ptr sz 14 (Suc n)\<rbrakk> \<Longrightarrow> ((\<forall>r. \<not> r \<le> word_of_nat n) \<or> is_aligned (ptr + (1 + word_of_nat n << 14)) 14) \<and> is_aligned (ptr + (1 + word_of_nat n << 14)) 14 proof (prove)
goal:
No subgoals! proof (state)
this:
createNewCaps ty ptr (Suc (Suc n)) us d s = (do x <- createNewCaps ty ptr (Suc n) us d;
r <- global.createObject ty ((1 + word_of_nat n << getObjectSize ty us) + ptr) us d;
return (x @ [r])
od) s

goal:
No subgoals!