theory Retype_R

lemma corres_retype_region_createNewCaps:
  "corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r')
               \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr ty)) ref us dev))
            (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s
                   \<and> caps_no_overlap y sz s \<and> pspace_no_overlap_range_cover y sz s
                   \<and> caps_overlap_reserved {y..y + of_nat n * 2 ^ (obj_bits_api (APIType_map2 (Inr ty)) us) - 1} s
                   \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s)
                   \<and> (APIType_map2 (Inr ty) = Structures_A.CapTableObject \<longrightarrow> 0 < us))
            (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
                  \<and> valid_pspace' s \<and> valid_arch_state' s
                  \<and> range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \<and> n\<noteq> 0)
            (do x \<leftarrow> retype_region y n us (APIType_map2 (Inr ty)) dev :: obj_ref list det_ext_monad;
                init_arch_objects (APIType_map2 (Inr ty)) y n us x;
                return x od)
            (createNewCaps ty y n us dev)" apply (rule_tac F="range_cover y sz
                       (obj_bits_api (APIType_map2 (Inr ty)) us) n \<and>
                     n \<noteq> 0 \<and>
                     (APIType_map2 (Inr ty) = Structures_A.CapTableObject
                       \<longrightarrow> 0 < us)"
            in corres_req, simp) apply (clarsimp simp add: createNewCaps_def toAPIType_def
                 split del: if_split cong: if_cong) apply (subst init_arch_objects_APIType_map2) apply (cases ty, simp_all add: Arch_createNewCaps_def
                      split del: if_split) apply (rename_tac apiobject_type) apply (case_tac apiobject_type, simp_all split del: if_split)
            \<comment> \<open>Untyped\<close> apply (simp     add: retype_region_def obj_bits_api_def
                                 APIType_map2_def
                      split del: if_split
                           cong: if_cong) apply (subst upto_enum_red') apply (drule range_cover_not_zero[rotated]) apply simp apply unat_arith apply (clarsimp simp: list_all2_same enum_word_def  range_cover.unat_of_nat_n
                                  list_all2_map1 list_all2_map2
                                  ptr_add_def fromIntegral_def toInteger_nat fromInteger_nat) apply (subst unat_of_nat_minus_1) apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing]) apply simp apply (clarsimp simp: range_cover_def) apply (arith+)[4]
           \<comment> \<open>TCB, EP, NTFN\<close> apply (simp_all add: retype_region2_ext_retype_region bind_cong[OF curDomain_mapM_x_futz refl, unfolded bind_assoc]
                     split del: if_split)[9]  (* not PageDirectoryObject *)
            apply (rule corres_guard_imp) apply (rule corres_split_eqr) apply (rule corres_retype[where 'a = tcb],
                       simp_all add: obj_bits_api_def objBits_simps' pageBits_def
                                    APIType_map2_def makeObjectKO_def
                                    other_objs_default_relation)[1] apply (fastforce simp: range_cover_def) apply (rule corres_split_nor) apply (simp add: APIType_map2_def) apply (rule retype_region2_extra_ext_mapM_x_corres) apply (rule corres_trivial, simp) apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2
                objBits_simps APIType_map2_def) apply wp apply wp apply ((wp retype_region2_obj_at | simp add: APIType_map2_def)+)[1] apply ((wp createObjects_tcb_at'[where sz=sz] | simp add: APIType_map2_def objBits_simps' obj_bits_api_def)+)[1] apply simp apply simp apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: liftM_def[symmetric] split del: if_split) apply (rule corres_rel_imp) apply (rule corres_guard_imp) apply (rule corres_retype[where 'a = endpoint],
                    simp_all add: obj_bits_api_def objBits_simps' pageBits_def
                                  APIType_map2_def makeObjectKO_def
                                  other_objs_default_relation)[1] apply (fastforce simp: range_cover_def) apply simp apply simp apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2
                                objBits_simps APIType_map2_def) apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: liftM_def[symmetric] split del: if_split) apply (rule corres_rel_imp) apply (rule corres_guard_imp) apply (rule corres_retype[where 'a = notification],
                   simp_all add: obj_bits_api_def objBits_simps' pageBits_def
                                 APIType_map2_def makeObjectKO_def
                                 other_objs_default_relation)[1] apply (fastforce simp: range_cover_def) apply simp apply simp apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2
                               objBits_simps APIType_map2_def)
        \<comment> \<open>CapTable\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (subst bind_assoc_return_reverse[of "createObjects y n (KOCTE makeObject) us"]) apply (subst liftM_def
               [of "map (\<lambda>addr. capability.CNodeCap addr us 0 0)", symmetric]) apply simp apply (rule corres_rel_imp) apply (rule corres_guard_imp) apply (rule corres_retype_update_gsI,
                 simp_all add: obj_bits_api_def objBits_simps' pageBits_def
                               APIType_map2_def makeObjectKO_def slot_bits_def
                               field_simps ext)[1] apply (simp add: range_cover_def) apply (rule captable_relation_retype,simp add: range_cover_def word_bits_def) apply simp apply simp apply (clarsimp simp: list_all2_same list_all2_map1 list_all2_map2
                              objBits_simps allRights_def APIType_map2_def
                   split del: if_split)
          \<comment> \<open>SmallPageObject\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split) apply (rule corres_rel_imp) apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split) apply (rule corres_guard_imp) apply (rule corres_retype_update_gsI,
                 simp_all add: APIType_map2_def makeObjectKO_def
                     arch_default_cap_def obj_bits_api_def3
                     default_object_def default_arch_object_def pageBits_def
                     ext objBits_simps range_cover.aligned,
                     simp_all add: data_page_relation_retype)[1] apply simp+ apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def
                vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)
         \<comment> \<open>LargePageObject\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split) apply (rule corres_rel_imp) apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split) apply (rule corres_guard_imp) apply (rule corres_retype_update_gsI,
                simp_all add: APIType_map2_def makeObjectKO_def
                    arch_default_cap_def obj_bits_api_def3
                    default_object_def default_arch_object_def pageBits_def
                    ext objBits_simps range_cover.aligned,
                    simp_all add: data_page_relation_retype)[1] apply simp+ apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def
               vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)
        \<comment> \<open>SectionObject\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split) apply (rule corres_rel_imp) apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split) apply (rule corres_guard_imp) apply (rule corres_retype_update_gsI,
               simp_all add: APIType_map2_def makeObjectKO_def
                   arch_default_cap_def obj_bits_api_def3
                   default_object_def default_arch_object_def pageBits_def
                   ext objBits_simps range_cover.aligned,
                   simp_all add: data_page_relation_retype)[1] apply simp+ apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def
              vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)
    \<comment> \<open>SuperSectionObject\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp add: corres_liftM2_simp[unfolded liftM_def] split del: if_split) apply (rule corres_rel_imp) apply (simp add: init_arch_objects_APIType_map2_noop split del: if_split) apply (rule corres_guard_imp) apply (rule corres_retype_update_gsI,
              simp_all add: APIType_map2_def makeObjectKO_def
                  arch_default_cap_def obj_bits_api_def3
                  default_object_def default_arch_object_def pageBits_def
                  ext objBits_simps range_cover.aligned,
                  simp_all add: data_page_relation_retype)[1] apply simp+ apply (simp add: APIType_map2_def arch_default_cap_def vmrights_map_def
             vm_read_write_def list_all2_map1 list_all2_map2 list_all2_same)
  \<comment> \<open>PageTable\<close> apply (subst retype_region2_extra_ext_trivial) apply (simp add: APIType_map2_def) apply (simp_all add: corres_liftM2_simp[unfolded liftM_def]) apply (rule corres_guard_imp) apply (simp add: init_arch_objects_APIType_map2_noop) apply (rule corres_rel_imp) apply (rule corres_retype[where 'a =pte],
            simp_all add: APIType_map2_def obj_bits_api_def
                          default_arch_object_def objBits_simps
                          archObjSize_def ptBits_def pageBits_def
                          pteBits_def pdeBits_def
                          makeObjectKO_def range_cover.aligned)[1] apply (rule pagetable_relation_retype) apply (wp | simp)+ apply (clarsimp simp: list_all2_map1 list_all2_map2 list_all2_same
                          APIType_map2_def arch_default_cap_def) apply simp+
  \<comment> \<open>PageDirectory\<close> apply (rule corres_guard_imp) apply (rule corres_split_eqr) apply (rule corres_retype[where ty = "Inr PageDirectoryObject" and 'a = pde
                    , simplified, folded retype_region2_ext_retype_region_ArchObject_PageDirectoryObj],
              simp_all add: APIType_map2_def obj_bits_api_def
                            default_arch_object_def objBits_simps
                            archObjSize_def pdBits_def pageBits_def
                            pteBits_def pdeBits_def
                            makeObjectKO_def)[1] apply (simp add: range_cover_def)+ apply (rule pagedirectory_relation_retype) apply (simp add: init_arch_objects_def APIType_map2_def
                       bind_assoc) apply (rule corres_split_nor) apply (simp add: mapM_x_mapM) apply (rule corres_underlying_split[where r' = dc]) apply (rule_tac Q="\<lambda>xs s. (\<forall>x \<in> set xs. page_directory_at x s)
                                   \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s"
                         and Q'="\<lambda>xs s. (\<forall>x \<in> set xs. page_directory_at' x s) \<and> valid_arch_state' s"
                         in corres_mapM_list_all2[where r'=dc and S="(=)"]) apply simp+ apply (rule corres_guard_imp, rule copyGlobalMappings_corres) apply simp+ apply (wp hoare_vcg_const_Ball_lift | simp)+ apply (simp add: list_all2_same) apply (rule corres_return[where P =\<top> and P'=\<top>,THEN iffD2]) apply simp apply wp+ apply (simp add: liftM_def[symmetric] o_def list_all2_map1
                         list_all2_map2 list_all2_same
                         arch_default_cap_def mapM_x_mapM) apply (simp add: dc_def[symmetric]) apply (rule corres_machine_op) apply (rule corres_Id) apply (simp add: shiftl_t2n shiftL_nat
                           pdBits_def ptBits_def pageBits_def pt_bits_def) defer apply simp apply (simp add: mapM_discarded[where g = "return ()",simplified,symmetric]) apply (rule no_fail_pre) apply (wp no_fail_mapM|clarsimp)+ apply (rule hoare_vcg_conj_lift) apply (rule hoare_post_imp) prefer 2 apply (rule hoare_vcg_conj_lift) apply (rule retype_region_obj_at) apply (simp add: APIType_map2_def) apply (subst APIType_map2_def, simp) apply (rule retype_region_ret) apply (clarsimp simp: retype_addrs_def obj_bits_api_def APIType_map2_def
                  default_arch_object_def default_object_def) apply (clarsimp simp: obj_at_def a_type_def) apply (wp retype_region_valid_arch retype_region_aligned|simp)+ apply (clarsimp simp: objBits_simps retype_addrs_def obj_bits_api_def
                           APIType_map2_def default_arch_object_def default_object_def) apply (rule hoare_vcg_conj_lift) apply (rule hoare_post_imp) prefer 2 apply (rule hoare_vcg_conj_lift) apply (rule createObjects_ko_at[where sz = sz and 'a = pde]) apply (simp add: objBits_simps archObjSize_def pdBits_def
                           pteBits_def pdeBits_def
                           pageBits_def page_directory_at'_def)+ apply (simp add: projectKOs) apply (rule createObjects_aligned) apply (simp add: objBits_simps archObjSize_def pdBits_def
                        pageBits_def page_directory_at'_def)+ apply (simp add: range_cover_def pteBits_def pdeBits_def) apply (rule le_less_trans[OF range_cover.range_cover_n_le(2) power_strict_increasing]) apply simp apply (clarsimp simp: range_cover_def word_bits_def) apply arith+ apply (simp add: objBits_simps archObjSize_def pdBits_def
                        pageBits_def page_directory_at'_def)+ apply (simp add: range_cover_def word_bits_def pteBits_def pdeBits_def) apply clarsimp apply (drule (1) bspec)+ apply (simp add: objBits_simps retype_addrs_def obj_bits_api_def pdBits_def pageBits_def
                       ptBits_def APIType_map2_def default_arch_object_def default_object_def
                       archObjSize_def) apply (clarsimp simp: objBits_simps archObjSize_def pdBits_def
                            pageBits_def page_directory_at'_def
                            pteBits_def pdeBits_def) apply (drule_tac x = ya in spec) apply (clarsimp simp:typ_at'_def obj_at'_real_def) apply (erule ko_wp_at'_weakenE) apply (clarsimp simp: projectKOs) apply (wp createObjects_valid_arch) apply (auto simp: objBits_simps retype_addrs_def obj_bits_api_def pdBits_def pageBits_def ptBits_def
                      APIType_map2_def default_arch_object_def default_object_def archObjSize_def
                      pteBits_def pdeBits_def
                      pd_bits_def fromIntegral_def toInteger_nat fromInteger_nat) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr ty)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr ty)) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (APIType_map2 (Inr ty) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \<and> n \<noteq> 0) (do x <- retype_region y n us (APIType_map2 (Inr ty)) dev;
init_arch_objects (APIType_map2 (Inr ty)) y n us x;
return x
od) (createNewCaps ty y n us dev) proof (prove)
goal (1 subgoal):
 1. range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \<and> n \<noteq> 0 \<and> (APIType_map2 (Inr ty) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr ty)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr ty)) us - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) slot s) \<and> (APIType_map2 (Inr ty) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s \<and> range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n \<and> n \<noteq> 0) (do x <- retype_region y n us (APIType_map2 (Inr ty)) dev;
init_arch_objects (APIType_map2 (Inr ty)) y n us x;
return x
od) (createNewCaps ty y n us dev) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n; 0 < n; APIType_map2 (Inr ty) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr ty)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr ty)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr ty)) dev;
y <- init_arch_objects (APIType_map2 (Inr ty)) y n us x;
return x
od) (case case ty of APIObjectType a \<Rightarrow> Just a | _ \<Rightarrow> Nothing of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty y n us dev;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral n - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr ty)) us) n; 0 < n; APIType_map2 (Inr ty) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr ty)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr ty)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr ty)) dev;
y <- case ty of APIObjectType x \<Rightarrow> return () | _ \<Rightarrow> init_arch_objects (APIType_map2 (Inr ty)) y n us x;
return x
od) (case case ty of APIObjectType x \<Rightarrow> Just x | _ \<Rightarrow> Nothing of None \<Rightarrow> do archCaps <- Arch_createNewCaps ty y n us dev;
return (map capability.ArchObjectCap archCaps)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral n - 1] | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od) proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType x1))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType x1)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType x1\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType x1))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType x1))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType x1))) dev) (case x1 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral n - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType apiobject_type))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType apiobject_type)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType apiobject_type\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType apiobject_type))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType apiobject_type))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType apiobject_type))) dev) (case apiobject_type of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ fromIntegral us) us 0) [0 .e. fromIntegral n - 1] | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
curdom <- curDomain;
mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return $ map capability.ThreadCap addrs
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) 0;
return $ map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do addrs <- createObjects y n (injectKOS makeObject) us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr `~elem~` map fromPPtr addrs then Just us else gsCNodes ks addr\<rparr>);
return $ map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.Untyped))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.Untyped)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.Untyped))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.Untyped))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.Untyped))) dev) (return (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) [0 .e. word_of_nat n - 1]))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (\<exists>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<exists>s'. pspace_aligned' s' \<and> pspace_distinct' s' \<and> pspace_no_overlap' y sz s' \<and> valid_pspace' s' \<and> valid_arch_state' s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> n = Suc (unat (word_of_nat n - 1)) \<and> list_all2 cap_relation (map ((\<lambda>ref. cap.UntypedCap dev ref us 0) \<circ> (\<lambda>p. ptr_add y (p * 2 ^ us))) [0..<n]) (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) [0 .e. word_of_nat n - 1])
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> 1 \<le> word_of_nat n
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (\<exists>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<exists>s'. pspace_aligned' s' \<and> pspace_distinct' s' \<and> pspace_no_overlap' y sz s' \<and> valid_pspace' s' \<and> valid_arch_state' s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> n = Suc (unat (word_of_nat n - 1)) \<and> list_all2 cap_relation (map ((\<lambda>ref. cap.UntypedCap dev ref us 0) \<circ> (\<lambda>p. ptr_add y (p * 2 ^ us))) [0..<n]) (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) (map word_of_nat [0..<unat (word_of_nat n)]))
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type. \<lbrakk>0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> n \<noteq> 0
 2. \<And>apiobject_type. \<lbrakk>0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped; word_of_nat n \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> word_of_nat n
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (\<exists>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<exists>s'. pspace_aligned' s' \<and> pspace_distinct' s' \<and> pspace_no_overlap' y sz s' \<and> valid_pspace' s' \<and> valid_arch_state' s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> n = Suc (unat (word_of_nat n - 1)) \<and> list_all2 cap_relation (map ((\<lambda>ref. cap.UntypedCap dev ref us 0) \<circ> (\<lambda>p. ptr_add y (p * 2 ^ us))) [0..<n]) (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) (map word_of_nat [0..<unat (word_of_nat n)]))
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped; word_of_nat n \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> word_of_nat n
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (\<exists>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<exists>s'. pspace_aligned' s' \<and> pspace_distinct' s' \<and> pspace_no_overlap' y sz s' \<and> valid_pspace' s' \<and> valid_arch_state' s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> n = Suc (unat (word_of_nat n - 1)) \<and> list_all2 cap_relation (map ((\<lambda>ref. cap.UntypedCap dev ref us 0) \<circ> (\<lambda>p. ptr_add y (p * 2 ^ us))) [0..<n]) (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) (map word_of_nat [0..<unat (word_of_nat n)]))
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; apiobject_type = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> (\<exists>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> (\<exists>s'. pspace_aligned' s' \<and> pspace_distinct' s' \<and> pspace_no_overlap' y sz s' \<and> valid_pspace' s' \<and> valid_arch_state' s' \<and> (s, s') \<in> state_relation)) \<longrightarrow> n = Suc (unat (word_of_nat n - 1)) \<and> list_all2 cap_relation (map ((\<lambda>ref. cap.UntypedCap dev ref us 0) \<circ> (\<lambda>p. ptr_add y (p * 2 ^ us))) [0..<n]) (map (\<lambda>n. capability.UntypedCap dev (y + n * 2 ^ us) us 0) (map word_of_nat [0..<unat (word_of_nat n)]))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n = Suc (unat (word_of_nat n - 1))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n < 2 ^ LENGTH(32)
 2. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n \<noteq> 0
 3. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n = Suc (n - 1)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> range_cover (?ptr55 s a s' b) (?sz55 s a s' b) (?sbit55 s a s' b) n
 2. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ?sz55 s a s' b - ?sbit55 s a s' b < LENGTH(32)
 3. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> 1 < 2
 4. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n \<noteq> 0
 5. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n = Suc (n - 1)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sz - us < LENGTH(32)
 2. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n = Suc (n - 1)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s a s' b. \<lbrakk>0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation; is_aligned y us; sz < 32; us \<le> sz; n + unat (y && mask sz >> us) \<le> 2 ^ (sz - us)\<rbrakk> \<Longrightarrow> sz - us < 32
 2. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<And>s a s' b. \<lbrakk>range_cover y sz us n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.Untyped; valid_pspace s; valid_mdb s; valid_etcbs s; valid_list s; valid_arch_state s; caps_no_overlap y sz s; pspace_no_overlap (up_aligned_area y sz) s; caps_overlap_reserved {y..y + word_of_nat n * 2 ^ us - 1} s; cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s; pspace_aligned' s'; pspace_distinct' s'; pspace_no_overlap' y sz s'; valid_pspace' s'; valid_arch_state' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> n = Suc (n - 1)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 14 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (do addrs <- createObjects y n (KOTCB makeObject) 0;
curdom <- curDomain;
y <- mapM_x (threadSet (tcbDomain_update (\<lambda>_. curdom))) addrs;
return (map capability.ThreadCap addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do addrs <- createObjects y n (KOTCB makeObject) 0;
v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) addrs;
return (map capability.ThreadCap addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do addrs <- createObjects y n (KOTCB makeObject) 0;
v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) addrs;
return (map capability.ThreadCap addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?Q181 apiobject_type) (?Q'181 apiobject_type) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do addrs <- createObjects y n (KOTCB makeObject) 0;
v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) addrs;
return (map capability.ThreadCap addrs)
od)
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q181 apiobject_type s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'181 apiobject_type s
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres (=) (?P185 apiobject_type) (?P'185 apiobject_type) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev) (createObjects y n (KOTCB makeObject) 0)
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R185 apiobject_type ptrs) (?R'185 apiobject_type ptrs) (do y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs;
return (map capability.ThreadCap ptrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>?R185 apiobject_type\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>?R'185 apiobject_type\<rbrace>
 5. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> (?P185 apiobject_type and ?Q185 apiobject_type) s
 6. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> (?P'185 apiobject_type and ?Q'185 apiobject_type) s
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz 9 n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> is_aligned y 9
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R185 apiobject_type ptrs) (?R'185 apiobject_type ptrs) (do y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs;
return (map capability.ThreadCap ptrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>?R185 apiobject_type\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>?R'185 apiobject_type\<rbrace>
 5. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 6. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R185 apiobject_type ptrs) (?R'185 apiobject_type ptrs) (do y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)));
return ptrs
od) (do v <- mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs;
return (map capability.ThreadCap ptrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>?R185 apiobject_type\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>?R'185 apiobject_type\<rbrace>
 4. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 5. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres dc (?P203 apiobject_type ptrs) (?P'203 apiobject_type ptrs) (retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)))) (mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs)
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R203 apiobject_type ptrs) (?R'203 apiobject_type ptrs) (return ptrs) (return (map capability.ThreadCap ptrs))
 3. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q203 apiobject_type ptrs\<rbrace> retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) \<lbrace>\<lambda>x. ?R203 apiobject_type ptrs\<rbrace>
 4. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x. ?R'203 apiobject_type ptrs\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. ?P203 apiobject_type ptrs and ?Q203 apiobject_type ptrs\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. ?P'203 apiobject_type ptrs and ?Q'203 apiobject_type ptrs\<rbrace>
 7. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 8. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 10. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api Structures_A.apiobject_type.TCBObject us) n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres dc (?P203 ArchTypes_H.apiobject_type.TCBObject ptrs) (?P'203 ArchTypes_H.apiobject_type.TCBObject ptrs) (retype_region2_extra_ext ptrs Structures_A.apiobject_type.TCBObject) (mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs)
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R203 apiobject_type ptrs) (?R'203 apiobject_type ptrs) (return ptrs) (return (map capability.ThreadCap ptrs))
 3. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q203 apiobject_type ptrs\<rbrace> retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) \<lbrace>\<lambda>x. ?R203 apiobject_type ptrs\<rbrace>
 4. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x. ?R'203 apiobject_type ptrs\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. ?P203 apiobject_type ptrs and ?Q203 apiobject_type ptrs\<rbrace>
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. ?P'203 apiobject_type ptrs and ?Q'203 apiobject_type ptrs\<rbrace>
 7. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 8. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 10. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev)) (?R203 apiobject_type ptrs) (?R'203 apiobject_type ptrs) (return ptrs) (return (map capability.ThreadCap ptrs))
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q203 apiobject_type ptrs\<rbrace> retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) \<lbrace>\<lambda>x. ?R203 apiobject_type ptrs\<rbrace>
 3. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x. ?R'203 apiobject_type ptrs\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. valid_etcbs and (\<lambda>s. \<forall>addr\<in>set ptrs. tcb_at addr s) and ?Q203 apiobject_type ptrs\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and ?Q'203 apiobject_type ptrs\<rbrace>
 6. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 7. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 10. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (\<exists>s s'. (s, s') \<in> state_relation) \<longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) ref us dev) ptrs) (map capability.ThreadCap ptrs)
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q203 apiobject_type ptrs\<rbrace> retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. valid_etcbs and (\<lambda>s. \<forall>addr\<in>set ptrs. tcb_at addr s) and ?Q203 apiobject_type ptrs\<rbrace>
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and ?Q'203 apiobject_type ptrs\<rbrace>
 6. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 7. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 10. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q203 apiobject_type ptrs\<rbrace> retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. valid_etcbs and (\<lambda>s. \<forall>addr\<in>set ptrs. tcb_at addr s) and ?Q203 apiobject_type ptrs\<rbrace>
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and ?Q'203 apiobject_type ptrs\<rbrace>
 5. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 6. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 9. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 apiobject_type ptrs\<rbrace> mapM_x (\<lambda>addr. do cdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. cdom)) addr
od) ptrs \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. valid_etcbs and (\<lambda>s. \<forall>addr\<in>set ptrs. tcb_at addr s) and (\<lambda>s. True)\<rbrace>
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and ?Q'203 apiobject_type ptrs\<rbrace>
 4. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 5. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 8. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 apiobject_type\<rbrace> retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) dev \<lbrace>\<lambda>ptrs. valid_etcbs and (\<lambda>s. \<forall>addr\<in>set ptrs. tcb_at addr s) and (\<lambda>s. True)\<rbrace>
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and (\<lambda>_. True)\<rbrace>
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q185 apiobject_type) s
 4. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 7. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 apiobject_type\<rbrace> createObjects y n (KOTCB makeObject) 0 \<lbrace>\<lambda>ptrs. (\<lambda>a. \<forall>addr\<in>set ptrs. tcb_at' addr a) and (\<lambda>_. True)\<rbrace>
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. valid_etcbs s \<and> True \<and> True)) s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and ?Q'185 apiobject_type) s
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. valid_etcbs s \<and> True \<and> True)) s
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and (\<lambda>s. (pspace_no_overlap' y sz s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> True)) s
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.TCBObject; apiobject_type = ArchTypes_H.apiobject_type.TCBObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOTCB makeObject = injectKOS val)) and (\<lambda>s. (pspace_no_overlap' y sz s \<and> pspace_aligned' s \<and> pspace_distinct' s) \<and> True)) s
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)));
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KOEndpoint makeObject) 0;
return (map (\<lambda>addr. capability.EndpointCap addr 0 True True True True) addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (createObjects y n (KOEndpoint makeObject) 0)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres (?r'235 apiobject_type) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (createObjects y n (KOEndpoint makeObject) 0)
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; ?r'235 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> corres (?r'235 apiobject_type) (?Q238 apiobject_type) (?Q'238 apiobject_type) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) dev) (createObjects y n (KOEndpoint makeObject) 0)
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q238 apiobject_type s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'238 apiobject_type s
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; ?r'235 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz 4 n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> is_aligned y 4
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOEndpoint makeObject = injectKOS val)
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 6. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOEndpoint makeObject = injectKOS val)
 3. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOEndpoint makeObject = injectKOS val)
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; apiobject_type = ArchTypes_H.apiobject_type.EndpointObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.EndpointObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.EndpointCap addr 0 True True True True)) \<circ> (\<lambda>x. x)) x ya
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)));
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KONotification makeObject) 0;
return (map (\<lambda>addr. capability.NotificationCap addr 0 True True) addrs)
od)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (createObjects y n (KONotification makeObject) 0)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres (?r'258 apiobject_type) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (createObjects y n (KONotification makeObject) 0)
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; ?r'258 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> corres (?r'258 apiobject_type) (?Q261 apiobject_type) (?Q'261 apiobject_type) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) dev) (createObjects y n (KONotification makeObject) 0)
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q261 apiobject_type s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'261 apiobject_type s
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; ?r'258 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz 4 n; 0 < n; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> is_aligned y 4
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KONotification makeObject = injectKOS val)
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 5. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KONotification makeObject = injectKOS val)
 3. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 4. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KONotification makeObject = injectKOS val)
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 3. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; apiobject_type = ArchTypes_H.apiobject_type.NotificationObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.NotificationObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.NotificationCap addr 0 True True)) \<circ> (\<lambda>x. x)) x ya
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)));
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- return ();
return ptrs
od) (do addrs <- createObjects y n (KOCTE makeObject) us;
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set addrs then Just us else gsCNodes ks addr\<rparr>);
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- return ();
return ptrs
od) (do x <- do x <- createObjects y n (KOCTE makeObject) us;
_ <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
return x
od;
return (map (\<lambda>addr. capability.CNodeCap addr us 0 0) x)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do ptrs <- retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev;
y <- return ();
return ptrs
od) (liftM (map (\<lambda>addr. capability.CNodeCap addr us 0 0)) (do x <- createObjects y n (KOCTE makeObject) us;
_ <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
return x
od))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres (\<lambda>x. (\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do x <- createObjects y n (KOCTE makeObject) us;
_ <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
return x
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres (?r'287 apiobject_type) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do x <- createObjects y n (KOCTE makeObject) us;
_ <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
return x
od)
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ?r'287 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> corres (?r'287 apiobject_type) (?Q290 apiobject_type) (?Q'290 apiobject_type) (retype_region2 y n us (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) dev) (do x <- createObjects y n (KOCTE makeObject) us;
_ <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>addr. if addr \<in> set x then Just us else gsCNodes ks addr\<rparr>);
return x
od)
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q290 apiobject_type s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'290 apiobject_type s
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ?r'287 apiobject_type x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (11 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (us + 4) n; 0 < n; 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> is_aligned y (us + 4)
 2. \<And>apiobject_type. \<lbrakk>range_cover y sz (us + 4) n; 0 < n; 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; us + 4 \<le> sz\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object Structures_A.apiobject_type.CapTableObject dev us) (KOCTE makeObject)
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 4. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 5. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ya = x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>apiobject_type. \<lbrakk>range_cover y sz (us + 4) n; 0 < n; 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; us + 4 \<le> sz\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object Structures_A.apiobject_type.CapTableObject dev us) (KOCTE makeObject)
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 3. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 4. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ya = x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 3. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ya = x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>apiobject_type s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 2. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ya = x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>apiobject_type x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) us) n; 0 < n; APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; apiobject_type = ArchTypes_H.apiobject_type.CapTableObject; ya = x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.CapTableObject))) ref us dev) x) r') \<circ> map (\<lambda>addr. capability.CNodeCap addr us 0 0)) ya
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SmallPageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr SmallPageObject) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ?r'310 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SmallPageObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; ?r'310 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ?r'310 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; ?r'310 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject\<rbrakk> \<Longrightarrow> corres ?r'310 ?Q313 ?Q'313 (retype_region2 y n us (APIType_map2 (Inr SmallPageObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 0;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSmallPage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) addrs)
od)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q313 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'313 s
 4. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; ?r'310 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SmallPageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 3. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SmallPageObject)) us) n; 0 < n; APIType_map2 (Inr SmallPageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SmallPageObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None) x\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SmallPageObject)) ref us dev) x) (map (capability.ArchObjectCap \<circ> (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSmallPage None)) x)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr LargePageObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<And>ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr LargePageObject) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ?r'343 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr LargePageObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; ?r'343 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ?r'343 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; ?r'343 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject\<rbrakk> \<Longrightarrow> corres ?r'343 ?Q346 ?Q'346 (retype_region2 y n us (APIType_map2 (Inr LargePageObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 4;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMLargePage else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) addrs)
od)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q346 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'346 s
 4. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; ?r'343 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr LargePageObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 3. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr LargePageObject)) us) n; 0 < n; APIType_map2 (Inr LargePageObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = LargePageObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None) x\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr LargePageObject)) ref us dev) x) (map (capability.ArchObjectCap \<circ> (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMLargePage None)) x)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<And>ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr SectionObject) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ?r'376 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SectionObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; ?r'376 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ?r'376 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; ?r'376 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject\<rbrakk> \<Longrightarrow> corres ?r'376 ?Q379 ?Q'379 (retype_region2 y n us (APIType_map2 (Inr SectionObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 8;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) addrs)
od)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q379 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'379 s
 4. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; ?r'376 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 3. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SectionObject)) us) n; 0 < n; APIType_map2 (Inr SectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SectionObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None) x\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SectionObject)) ref us dev) x) (map (capability.ArchObjectCap \<circ> (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSection None)) x)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr SuperSectionObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<And>ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr SuperSectionObject) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ?r'409 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr SuperSectionObject)) y n us x;
return x
od) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; ?r'409 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ?r'409 (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od)
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; ?r'409 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> corres ?r'409 ?Q412 ?Q'412 (retype_region2 y n us (APIType_map2 (Inr SuperSectionObject)) dev) (do addrs <- createObjects y n (if dev then KOUserDataDevice else KOUserData) 12;
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>addr. if addr \<in> set addrs then Just ARMSuperSection else gsUserPages ks addr\<rparr>);
return (map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) addrs)
od)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q412 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'412 s
 4. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; ?r'409 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s
 3. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) x\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) x) r') \<circ> map capability.ArchObjectCap) ya
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (3 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr SuperSectionObject)) us) n; 0 < n; APIType_map2 (Inr SuperSectionObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = SuperSectionObject; ya = map (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None) x\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr SuperSectionObject)) ref us dev) x) (map (capability.ArchObjectCap \<circ> (\<lambda>n. arch_capability.PageCap dev n VMReadWrite ARMSuperSection None)) x)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- retype_region2_extra_ext ptrs (APIType_map2 (Inr PageTableObject));
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (3 subgoals):
 1. \<And>ptrs. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr PageTableObject) \<noteq> APIType_map2 (Inr (APIObjectType ArchTypes_H.apiobject_type.TCBObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- do ptrs <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- return ();
return ptrs
od;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject);
return (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) addrs)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres ((\<lambda>r r'. length r = length r' \<and> list_all2 cap_relation r r') \<circ> map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev)) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do archCaps <- do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od;
return (map capability.ArchObjectCap archCaps)
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres (\<lambda>addrs. (\<lambda>r'. length addrs = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) addrs) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject))
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres (\<lambda>addrs. (\<lambda>r'. length addrs = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) addrs) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) ?Q442 ?Q'442 (do x <- retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageTableObject)) y n us x;
return x
od) (createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject))
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q442 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'442 s
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres (\<lambda>addrs. (\<lambda>r'. length addrs = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) addrs) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) ?Q442 ?Q'442 (retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev) (createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject))
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q442 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'442 s
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject\<rbrakk> \<Longrightarrow> corres ?r'446 ?Q442 ?Q'442 (retype_region2 y n us (APIType_map2 (Inr PageTableObject)) dev) (createObjects y n (KOArch (KOPTE makeObject)) (ptBits - objBits makeObject))
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; ?r'446 x ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) x) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) ya
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q442 s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'442 s
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz 10 n; 0 < n; ty = PageTableObject; 10 \<le> sz\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject PageTableObj) dev us) (KOArch (KOPTE makeObject))
 2. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) x) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) ya
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPTE makeObject) = injectKOS val)
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (4 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; x = ya\<rbrakk> \<Longrightarrow> ((\<lambda>r'. length x = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) x) r') \<circ> map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None))) ya
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPTE makeObject) = injectKOS val)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (4 subgoals):
 1. \<And>x ya. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; x = ya\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageTableObject)) ref us dev) ya) (map (capability.ArchObjectCap \<circ> (\<lambda>pt. arch_capability.PageTableCap pt None)) ya)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPTE makeObject) = injectKOS val)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageTableObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageTableObject)) us) n; 0 < n; APIType_map2 (Inr PageTableObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageTableObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPTE makeObject) = injectKOS val)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (\<lambda>s. valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)) (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s) (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) ?Q460 ?Q'460 (do x <- retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev;
y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do addrs <- createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject);
y <- do y <- mapM_x copyGlobalMappings addrs;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) addrs)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) addrs)
od)
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ?Q460 s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ?Q'460 s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (=) ?P464 ?P'464 (retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev) (createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (?R464 x) (?R'464 x) (do y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do y <- do y <- mapM_x copyGlobalMappings x;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?R464\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>?R'464\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> (?P464 and ?Q464) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> (?P'464 and ?Q'464) s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> is_aligned y 14
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; 14 \<le> sz\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject PageDirectoryObj) dev us) (KOArch (KOPDE makeObject))
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (?R464 x) (?R'464 x) (do y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do y <- do y <- mapM_x copyGlobalMappings x;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?R464\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>?R'464\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (6 subgoals):
 1. \<lbrakk>is_aligned y 14 \<and> sz < 32 \<and> n + unat (y && mask sz >> 14) \<le> 2 ^ (sz - 14); 0 < n; ty = PageDirectoryObject; 14 \<le> sz\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject PageDirectoryObj) dev us) (KOArch (KOPDE makeObject))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (?R464 x) (?R'464 x) (do y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do y <- do y <- mapM_x copyGlobalMappings x;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?R464\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>?R'464\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. default_cap (APIType_map2 (Inr PageDirectoryObject)) ref us dev) archCaps) r') \<circ> map capability.ArchObjectCap) (?R464 x) (?R'464 x) (do y <- init_arch_objects (APIType_map2 (Inr PageDirectoryObject)) y n us x;
return x
od) (do y <- do y <- mapM_x copyGlobalMappings x;
doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
od;
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?R464\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>?R'464\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R464 x) (?R'464 x) (do xa <- mapM_x copy_global_mappings x;
y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do xa <- mapM_x copyGlobalMappings x;
y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?R464\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>?R'464\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres dc (?P480 x) (?P'480 x) (mapM_x copy_global_mappings x) (mapM_x copyGlobalMappings x)
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. ?P480 x and ?Q480 x\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. ?P'480 x and ?Q'480 x\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres dc (?P480 x) (?P'480 x) (do x <- mapM copy_global_mappings x;
return ()
od) (do x <- mapM copyGlobalMappings x;
return ()
od)
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. ?P480 x and ?Q480 x\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. ?P'480 x and ?Q'480 x\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (11 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres dc (?P480 x) (?P'480 x) (mapM copy_global_mappings x) (mapM copyGlobalMappings x)
 2. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P480 x\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'480 x\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. ?P480 x and ?Q480 x\<rbrace>
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. ?P'480 x and ?Q'480 x\<rbrace>
 10. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
A total of 11 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> dc [] []
 2. \<And>x xa xs ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xs ys; dc xa ya\<rbrakk> \<Longrightarrow> dc (xa # xs) (ya # ys)
 3. \<And>x xa xs ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; list_all2 (=) xs ys\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. (\<forall>x\<in>set (xa # xs). typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) (\<lambda>s. (\<forall>x\<in>set (ya # ys). page_directory_at' x s) \<and> valid_arch_state' s) (copy_global_mappings xa) (copyGlobalMappings ya)
 4. \<And>x xa xs ya. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (xa # xs) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (xa # xs). typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> copy_global_mappings xa \<lbrace>\<lambda>r s. (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 5. \<And>x xa ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (ya # ys) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (ya # ys). page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> copyGlobalMappings ya \<lbrace>\<lambda>r s. (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> list_all2 (=) x x
 7. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 10. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>xa xs ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; list_all2 (=) xs ys\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. typ_at (AArch APageDirectory) ya s \<and> (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) (\<lambda>s. page_directory_at' ya s \<and> (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s) (copy_global_mappings ya) (copyGlobalMappings ya)
 2. \<And>x xa xs ya. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (xa # xs) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (xa # xs). typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> copy_global_mappings xa \<lbrace>\<lambda>r s. (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 3. \<And>x xa ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (ya # ys) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (ya # ys). page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> copyGlobalMappings ya \<lbrace>\<lambda>r s. (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> list_all2 (=) x x
 5. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 10. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>xa xs ya ys s. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; list_all2 (=) xs ys; typ_at (AArch APageDirectory) ya s \<and> (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_arch_state and valid_etcbs and pspace_aligned and typ_at (AArch APageDirectory) ya) s
 2. \<And>xa xs ya ys s. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; list_all2 (=) xs ys; page_directory_at' ya s \<and> (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> (valid_arch_state' and page_directory_at' ya) s
 3. \<And>x xa xs ya. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (xa # xs) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (xa # xs). typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> copy_global_mappings xa \<lbrace>\<lambda>r s. (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 4. \<And>x xa ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (ya # ys) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (ya # ys). page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> copyGlobalMappings ya \<lbrace>\<lambda>r s. (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> list_all2 (=) x x
 6. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 10. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x xa xs ya. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (ya # xs) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. typ_at (AArch APageDirectory) ya s \<and> (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> copy_global_mappings ya \<lbrace>\<lambda>r s. (\<forall>x\<in>set xs. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 2. \<And>x xa ya ys. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; xa = ya; suffix (ya # ys) x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set (ya # ys). page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> copyGlobalMappings ya \<lbrace>\<lambda>r s. (\<forall>x\<in>set ys. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> list_all2 (=) x x
 4. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 10. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> list_all2 (=) x x
 2. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 9. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 10. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> corres dc (?Q485 x xa) (?Q'485 x xb) (return ()) (return ())
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>?Q485 x\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>?Q'485 x\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 10. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (10 subgoals):
 1. \<And>x xa xb. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; dc xa xb\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> state_relation) \<longrightarrow> dc () ()
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>\<lambda>xa _. True\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>\<lambda>xb _. True\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 8. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 10. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace> mapM copy_global_mappings x \<lbrace>\<lambda>xa _. True\<rbrace>
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace> mapM copyGlobalMappings x \<lbrace>\<lambda>xb _. True\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>archCaps. (\<lambda>r'. length archCaps = length r' \<and> list_all2 cap_relation (map (\<lambda>ref. cap.ArchObjectCap (arch_default_cap PageDirectoryObj ref us dev)) archCaps) r') \<circ> map capability.ArchObjectCap) (?R480 x) (?R'480 x) (do y <- do_machine_op (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x);
return x
od) (do y <- doMachineOp (mapM_x (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x);
return (map (\<lambda>pt. arch_capability.PageDirectoryCap pt None) x)
od)
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres (\<lambda>x xa. True) (?R480 x) (?R'480 x) (do_machine_op (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x))) (doMachineOp (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres dc (?R480 x) (?R'480 x) (do_machine_op (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x))) (doMachineOp (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>xa. ?R480 x\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>xa. ?R'480 x\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> corres_underlying Id False True dc (\<lambda>_. True) (\<lambda>_. True) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x)) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
 2. \<And>x rv. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> dc rv rv
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x))
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x)
 2. \<And>x rv. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> dc rv rv
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x))
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 7. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s proof (prove)
goal (9 subgoals):
 1. \<And>x rv. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> dc rv rv
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x))
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x))
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
 2. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> no_fail (?P531 x) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + word_of_nat (shiftL (Suc 0) pdBits) - 1) (addrFromPPtr x)) x)
 2. \<And>x s. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject; True\<rbrakk> \<Longrightarrow> ?P531 x s
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q480 x\<rbrace> mapM_x copy_global_mappings x \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'480 x\<rbrace> mapM_x copyGlobalMappings x \<lbrace>\<lambda>x _. True\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s) and ?Q480 x\<rbrace>
 6. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and ?Q'480 x\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q464\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>x s. (\<forall>x\<in>set x. typ_at (AArch APageDirectory) x s) \<and> valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and ?Q464) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s\<rbrace>
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. ?P551 s \<and> ?P'551 s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; ?Q554 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q554\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. ?P551 s \<and> ?P'551 s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q554\<rbrace>
 2. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; ?Q554 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. ?P551 s \<and> ?P'551 s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P557\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q557\<rbrace>
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'557\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q'557\<rbrace>
 3. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; ?Q557 rv s \<and> ?Q'557 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (?P557 s \<and> ?P'557 s) \<and> ?P'551 s)) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> APIType_map2 (Inr PageDirectoryObject) \<noteq> Structures_A.apiobject_type.Untyped
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'557\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q'557\<rbrace>
 3. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; (\<forall>x\<in>set (retype_addrs y (APIType_map2 (Inr PageDirectoryObject)) n us). obj_at (\<lambda>ko. ko = default_object (APIType_map2 (Inr PageDirectoryObject)) dev us) x s) \<and> ?Q'557 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 5. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> ?P'557 s) \<and> ?P'551 s)) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'557\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>?Q'557\<rbrace>
 2. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; (\<forall>x\<in>set (retype_addrs y (APIType_map2 (Inr PageDirectoryObject)) n us). obj_at (\<lambda>ko. ko = default_object (APIType_map2 (Inr PageDirectoryObject)) dev us) x s) \<and> ?Q'557 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> ?P'557 s) \<and> ?P'551 s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'557\<rbrace> retype_region y n us (ArchObject PageDirectoryObj) dev \<lbrace>?Q'557\<rbrace>
 2. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; (\<forall>x\<in>set (retype_addrs y (APIType_map2 (Inr PageDirectoryObject)) n us). obj_at (\<lambda>ko. ko = default_object (APIType_map2 (Inr PageDirectoryObject)) dev us) x s) \<and> ?Q'557 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 4. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> ?P'557 s) \<and> ?P'551 s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; (\<forall>x\<in>set (retype_addrs y (APIType_map2 (Inr PageDirectoryObject)) n us). obj_at (\<lambda>ko. ko = default_object (APIType_map2 (Inr PageDirectoryObject)) dev us) x s) \<and> rv = map (\<lambda>p. ptr_add y (p * 2 ^ obj_bits_api (ArchObject PageDirectoryObj) us)) [0..<n]\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. typ_at (AArch APageDirectory) x s
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> ?P'551 s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<And>s x. \<lbrakk>range_cover y sz 14 n; ty = PageDirectoryObject; \<forall>x\<in>{0..<n}. obj_at (\<lambda>ko. ko = ArchObj (PageDirectory (\<lambda>x. ARM_A.InvalidPDE))) (ptr_add y (x * 16384)) s; x < n\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) (ptr_add y (x * 16384)) s
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 3. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> ?P'551 s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'551\<rbrace> retype_region y n us (APIType_map2 (Inr PageDirectoryObject)) dev \<lbrace>\<lambda>rv s. valid_arch_state s \<and> pspace_aligned s \<and> valid_etcbs s\<rbrace>
 2. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x. (\<lambda>s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s) and (\<lambda>_. True)\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> ?P'551 s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - objBits makeObject) \<lbrace>\<lambda>x s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?Q'464\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>x s. (\<forall>x\<in>set x. page_directory_at' x s) \<and> valid_arch_state' s\<rbrace>
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and ?Q'464) s
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv s. \<forall>x\<in>set rv. page_directory_at' x s\<rbrace>
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ?P586 s \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; ?Q589 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q589\<rbrace>
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ?P586 s \<and> ?P'586 s)) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q589\<rbrace>
 2. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; ?Q589 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ?P586 s \<and> ?P'586 s)) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P592\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q592\<rbrace>
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'592\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q'592\<rbrace>
 3. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; ?Q592 rv s \<and> ?Q'592 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. (?P592 s \<and> ?P'592 s) \<and> ?P'586 s)) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> range_cover y sz (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))) n
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> projectKO_opt (KOArch (KOPDE makeObject)) = Some ?val595
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'592\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q'592\<rbrace>
 5. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' ?val595 (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> ?Q'592 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 6. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> ?P'592 s) \<and> ?P'586 s)) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> projectKO_opt (KOArch (KOPDE makeObject)) = Some ?val595
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'592\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q'592\<rbrace>
 3. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' ?val595 (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> ?Q'592 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> ?P'592 s) \<and> ?P'586 s)) s
 7. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'592\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>?Q'592\<rbrace>
 2. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> ?Q'592 rv s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> ?P'592 s) \<and> ?P'586 s)) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> is_aligned y (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)))
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n < 2 ^ word_bits
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 5. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 6. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> is_aligned y (pdeBits + 12)
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n < 2 ^ word_bits
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 5. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 6. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n < 2 ^ word_bits
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 4. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 5. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 6. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 8. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> range_cover ?ptr607 ?sz607 ?sbit607 n
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> ?sz607 - ?sbit607 < word_bits
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> 1 < 2
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 5. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 6. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 7. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 9. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 10. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> sz - 14 < word_bits
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 5. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 6. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>0 < n; ty = PageDirectoryObject; is_aligned y 14; sz < 32; 14 \<le> sz; n + unat (y && mask sz >> 14) \<le> 2 ^ (sz - 14)\<rbrakk> \<Longrightarrow> sz - 14 < 32
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> 1 < 2
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> n \<noteq> 0
 4. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 5. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 6. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 7. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 8. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 9. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)) < word_bits
 2. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> pdeBits + 12 < word_bits
 2. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 3. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 5. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 6. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; (\<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s) \<and> (\<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rv. page_directory_at' x s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; \<forall>x\<in>set rv. \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s; \<forall>x\<in>set rv. is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)))\<rbrakk> \<Longrightarrow> page_directory_at' x s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; \<forall>offs<2 ^ (pdBits - archObjSize (KOPDE makeObject)). ko_at' makeObject (x + (offs << objBitsKO (KOArch (KOPDE makeObject)))) s; is_aligned x (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject)))\<rbrakk> \<Longrightarrow> page_directory_at' x s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; \<forall>offs<0x1000. ko_at' makeObject (x + (offs << pdeBits)) s; is_aligned x (pdeBits + 12)\<rbrakk> \<Longrightarrow> page_directory_at' x s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x ya. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; \<forall>offs<0x1000. ko_at' makeObject (x + (offs << 2)) s; is_aligned x 14; ya < 0x1000\<rbrakk> \<Longrightarrow> pde_at' (x + (ya << 2)) s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x ya. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; is_aligned x 14; ya < 0x1000; ya < 0x1000 \<longrightarrow> ko_at' makeObject (x + (ya << 2)) s\<rbrakk> \<Longrightarrow> pde_at' (x + (ya << 2)) s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x ya. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; is_aligned x 14; ya < 0x1000; ko_wp_at' (\<lambda>ko. projectKO_opt ko = Some makeObject) (x + (ya << 2)) s\<rbrakk> \<Longrightarrow> ko_wp_at' (\<lambda>ko. koTypeOf ko = ArchT PDET) (x + (ya << 2)) s
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (5 subgoals):
 1. \<And>rv s x ya ko. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject; x \<in> set rv; is_aligned x 14; ya < 0x1000; projectKO_opt ko = Some makeObject\<rbrakk> \<Longrightarrow> koTypeOf ko = ArchT PDET
 2. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 4. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 5. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover y sz 14 n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?P'586\<rbrace> createObjects y n (KOArch (KOPDE makeObject)) (pdBits - archObjSize (KOPDE makeObject)) \<lbrace>\<lambda>rv. valid_arch_state'\<rbrace>
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 3. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> ?P'586 s)) s
 4. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; valid_pspace s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s \<and> valid_arch_state s \<and> caps_no_overlap y sz s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y sz \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_pspace s \<and> pspace_no_overlap (up_aligned_area y sz) s \<and> valid_mdb s \<and> valid_etcbs s \<and> valid_list s) and (\<lambda>s. (True \<and> True) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz571 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz571 s \<and> pspace_no_overlap (up_aligned_area y ?sz571) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz571 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> valid_arch_state s) \<and> (valid_pspace s \<and> valid_mdb s \<and> range_cover y ?sz575 (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n \<and> caps_overlap_reserved {y..y + word_of_nat n * 2 ^ obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us - 1} s \<and> caps_no_overlap y ?sz575 s \<and> pspace_no_overlap (up_aligned_area y ?sz575) s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area y ?sz575 \<subseteq> cap_range c \<and> cap_is_device c = dev) (a, b) s) \<and> pspace_aligned s) \<and> valid_etcbs s)) s
 2. \<And>s. \<lbrakk>range_cover y sz (obj_bits_api (APIType_map2 (Inr PageDirectoryObject)) us) n; 0 < n; APIType_map2 (Inr PageDirectoryObject) = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ty = PageDirectoryObject; pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> valid_pspace' s \<and> valid_arch_state' s\<rbrakk> \<Longrightarrow> ((\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y sz s \<and> (\<exists>val. KOArch (KOPDE makeObject) = KOArch (KOPDE val))) and (\<lambda>s. ((pspace_no_overlap' y sz s \<and> valid_pspace' s) \<and> True) \<and> valid_arch_state' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' y ?sz673 s \<and> range_cover y ?sz673 (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - archObjSize (KOPDE makeObject))) n \<and> n \<noteq> 0)) s
 3. \<And>x. \<lbrakk>range_cover y sz (obj_bits_api (ArchObject PageDirectoryObj) us) n; 0 < n; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ pd_bits - 1) (addrFromPPtr x)) x) = liftM (\<lambda>x. ()) (mapM (\<lambda>x. cleanCacheRange_PoU x (x + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr x)) x) proof (prove)
goal:
No subgoals!