theory ArchRetype_IF

lemma retype_region_globals_equiv[Retype_IF_assms]:
  notes blah[simp del] = atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
                         Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex
  shows
    "\<lbrace>globals_equiv s and invs
                      and (\<lambda>s. \<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot s \<and>
                                   (i \<le> unat (p && mask sz) \<or> pspace_no_overlap_range_cover p sz s))
                      and K (range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num)\<rbrace>
     retype_region p num o_bits type dev
     \<lbrace>\<lambda>_. globals_equiv s\<rbrace>" apply (simp only: retype_region_def foldr_upd_app_if fun_app_def K_bind_def) apply (wp dxo_wp_weak |simp)+ apply (simp add: trans_state_update[symmetric] del: trans_state_update) apply (wp | simp)+ apply clarsimp apply (simp only: globals_equiv_def) apply (clarsimp split del: if_split) apply (subgoal_tac "pspace_no_overlap_range_cover p sz sa") apply (rule conjI) apply (clarsimp simp: pspace_no_overlap_def) apply (drule_tac x="arm_global_pd (arch_state sa)" in spec) apply (clarsimp simp: invs_def valid_state_def valid_global_objs_def
                          valid_vso_at_def obj_at_def ptr_add_def) apply (frule_tac p=x in range_cover_subset) apply (simp add: blah) apply simp apply (frule range_cover_subset') apply simp apply (clarsimp simp: p_assoc_help) apply (drule disjoint_subset_neg1[OF _ subset_thing], rule is_aligned_no_wrap') apply (clarsimp simp: valid_pspace_def pspace_aligned_def) apply (drule_tac x="arm_global_pd (arch_state sa)" and A="dom (kheap sa)"  in bspec) apply (simp add: domI) apply simp apply (rule word_power_less_1) apply (case_tac ao, simp_all add: arch_kobj_size_def word_bits_def) apply (simp add: pageBits_def) apply (simp add: pageBitsForSize_def split: vmpage_size.splits) apply (drule (1) subset_trans) apply (erule_tac P="a \<in> b" for a b in notE) apply (erule_tac A="{p + c..d}" for c d in subsetD) apply (simp add: blah) apply (rule is_aligned_no_wrap') apply (rule is_aligned_add[OF _ is_aligned_mult_triv2]) apply (simp add: range_cover_def) apply (rule word_power_less_1) apply (simp add: range_cover_def) apply (erule updates_not_idle) apply (clarsimp simp: pspace_no_overlap_def) apply (drule_tac x="idle_thread sa" in spec) apply (clarsimp simp: invs_def valid_state_def valid_global_objs_def valid_ao_at_def
                         obj_at_def ptr_add_def valid_idle_def pred_tcb_at_def) apply (frule_tac p=a in range_cover_subset) apply (simp add: blah) apply simp apply (frule range_cover_subset') apply simp apply (clarsimp simp: p_assoc_help) apply (drule disjoint_subset_neg1[OF _ subset_thing], rule is_aligned_no_wrap') apply (clarsimp simp: valid_pspace_def pspace_aligned_def) apply (drule_tac x="idle_thread sa" and A="dom (kheap sa)"  in bspec) apply (simp add: domI) apply simp apply uint_arith apply simp+ apply (drule (1) subset_trans) apply (erule_tac P="a \<in> b" for a b in notE) apply (erule_tac A="{idle_thread_ptr..d}" for d in subsetD) apply (simp add: blah) apply (erule_tac t=idle_thread_ptr in subst) apply (rule is_aligned_no_wrap') apply (rule is_aligned_add[OF _ is_aligned_mult_triv2]) apply (simp add: range_cover_def)+ apply (auto intro!: cte_wp_at_pspace_no_overlapI simp: range_cover_def word_bits_def)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>globals_equiv s and invs and (\<lambda>s. \<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot s \<and> (i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) s)) and K (range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num)\<rbrace> retype_region p num o_bits type dev \<lbrace>\<lambda>_. globals_equiv s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>globals_equiv s and invs and (\<lambda>s. \<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot s \<and> (i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) s)) and K (range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num)\<rbrace> do obj_size <- return (2 ^ obj_bits_api type o_bits);
ptrs <- return (map (\<lambda>pa. ptr_add p (pa * obj_size)) [0..<num]);
y <- when (type \<noteq> Untyped) (do kh <- gets kheap;
kh' <- return (\<lambda>x. if x \<in> set ptrs then Some (default_object type dev o_bits) else kh x);
y <- do_extended_op (retype_region_ext ptrs type);
modify (kheap_update (K kh'))
od);
return ptrs
od \<lbrace>\<lambda>_. globals_equiv s\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>kh' sa f. type \<noteq> Untyped \<Longrightarrow> globals_equiv s (trans_state f sa\<lparr>kheap := kh'\<rparr>) = globals_equiv s (sa\<lparr>kheap := kh'\<rparr>)
 2. \<And>obj_size ptrs kh. type \<noteq> Untyped \<Longrightarrow> \<lbrace>?B6 obj_size ptrs kh\<rbrace> return (\<lambda>x. if x \<in> set ptrs then Some (default_object type dev o_bits) else kh x) \<lbrace>\<lambda>kh' sa. globals_equiv s (kheap_update (K kh') sa)\<rbrace>
 3. \<And>obj_size ptrs. type \<noteq> Untyped \<Longrightarrow> \<lbrace>?Q5 obj_size ptrs\<rbrace> gets kheap \<lbrace>?B6 obj_size ptrs\<rbrace>
 4. \<And>obj_size. \<lbrace>?B1 obj_size\<rbrace> return (map (\<lambda>pa. ptr_add p (pa * obj_size)) [0..<num]) \<lbrace>\<lambda>ptrs. if type \<noteq> Untyped then ?Q5 obj_size ptrs else globals_equiv s\<rbrace>
 5. \<lbrace>?Q\<rbrace> return (2 ^ obj_bits_api type o_bits) \<lbrace>?B1\<rbrace>
 6. \<And>sa. (globals_equiv s and invs and (\<lambda>s. \<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot s \<and> (i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) s)) and K (range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num)) sa \<Longrightarrow> ?Q sa proof (prove)
goal (5 subgoals):
 1. \<And>obj_size ptrs kh. type \<noteq> Untyped \<Longrightarrow> \<lbrace>?B6 obj_size ptrs kh\<rbrace> return (\<lambda>x. if x \<in> set ptrs then Some (default_object type dev o_bits) else kh x) \<lbrace>\<lambda>kh' sa. globals_equiv s (kheap_update (K kh') sa)\<rbrace>
 2. \<And>obj_size ptrs. type \<noteq> Untyped \<Longrightarrow> \<lbrace>?Q5 obj_size ptrs\<rbrace> gets kheap \<lbrace>?B6 obj_size ptrs\<rbrace>
 3. \<And>obj_size. \<lbrace>?B1 obj_size\<rbrace> return (map (\<lambda>pa. ptr_add p (pa * obj_size)) [0..<num]) \<lbrace>\<lambda>ptrs. if type \<noteq> Untyped then ?Q5 obj_size ptrs else globals_equiv s\<rbrace>
 4. \<lbrace>?Q\<rbrace> return (2 ^ obj_bits_api type o_bits) \<lbrace>?B1\<rbrace>
 5. \<And>sa. (globals_equiv s and invs and (\<lambda>s. \<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot s \<and> (i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) s)) and K (range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num)) sa \<Longrightarrow> ?Q sa proof (prove)
goal (1 subgoal):
 1. \<And>sa. globals_equiv s sa \<and> invs sa \<and> (\<exists>i. cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa \<and> (i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa)) \<and> range_cover p sz (obj_bits_api type o_bits) num \<and> 0 < num \<Longrightarrow> type \<noteq> Untyped \<longrightarrow> globals_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>sa i. \<lbrakk>globals_equiv s sa; invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped\<rbrakk> \<Longrightarrow> globals_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>sa i. \<lbrakk>arch_globals_equiv (cur_thread s) (idle_thread s) (kheap s) (kheap sa) (arch_state s) (arch_state sa) (machine_state s) (machine_state sa) \<and> idle_equiv s sa \<and> cur_thread s = cur_thread sa \<and> dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped\<rbrakk> \<Longrightarrow> arch_globals_equiv (cur_thread sa) (idle_thread s) (kheap s) (kheap (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)) (arch_state s) (arch_state (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)) (machine_state s) (machine_state (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)) \<and> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>) \<and> cur_thread sa = cur_thread (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>) \<and> dom (device_state (machine_state sa)) = dom (device_state (machine_state (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>))) proof (prove)
goal (1 subgoal):
 1. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> kheap sa (arm_global_pd (arch_state sa)) = (if arm_global_pd (arch_state sa) \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa (arm_global_pd (arch_state s))) \<and> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> kheap sa (arm_global_pd (arch_state sa)) = (if arm_global_pd (arch_state sa) \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa (arm_global_pd (arch_state s))) \<and> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> kheap sa (arm_global_pd (arch_state sa)) = (if arm_global_pd (arch_state sa) \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa (arm_global_pd (arch_state s)))
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = ptr_add p (x * 2 ^ obj_bits_api type o_bits); kheap s (ptr_add p (x * 2 ^ obj_bits_api type o_bits)) = kheap sa (ptr_add p (x * 2 ^ obj_bits_api type o_bits)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); \<forall>x ko. kheap sa x = Some ko \<longrightarrow> {x..x + (2 ^ obj_bits ko - 1)} \<inter> up_aligned_area p sz = {}; arm_global_pd (arch_state sa) = ptr_add p (x * 2 ^ obj_bits_api type o_bits); x \<in> {0..<num}\<rbrakk> \<Longrightarrow> kheap sa (ptr_add p (x * 2 ^ obj_bits_api type o_bits)) = Some (default_object type dev o_bits)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = ptr_add p (x * 2 ^ obj_bits_api type o_bits); kheap s (ptr_add p (x * 2 ^ obj_bits_api type o_bits)) = kheap sa (ptr_add p (x * 2 ^ obj_bits_api type o_bits)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = ptr_add p (x * 2 ^ obj_bits_api type o_bits); x \<in> {0..<num}; \<forall>ko. kheap sa (arm_global_pd (arch_state sa)) = Some ko \<longrightarrow> {arm_global_pd (arch_state sa)..arm_global_pd (arch_state sa) + (2 ^ obj_bits ko - 1)} \<inter> up_aligned_area p sz = {}\<rbrakk> \<Longrightarrow> kheap sa (ptr_add p (x * 2 ^ obj_bits_api type o_bits)) = Some (default_object type dev o_bits)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> x < num
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> num \<noteq> 0
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 5. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> num \<noteq> 0
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> num \<noteq> 0
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..(p && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..(p && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ arch_kobj_size ao - 1)} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (7 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) (?sz102 sa i x ao)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 2 ^ arch_kobj_size ao - 1 < 2 ^ ?sz102 sa i x ao
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 5. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 7. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (7 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; \<forall>x\<in>dom (kheap sa). is_aligned x (obj_bits (the (kheap sa x))); pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa)\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) (?sz102 sa i x ao)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 2 ^ arch_kobj_size ao - 1 < 2 ^ ?sz102 sa i x ao
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 5. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 7. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (8 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa)\<rbrakk> \<Longrightarrow> arm_global_pd (arch_state sa) \<in> dom (kheap sa)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); is_aligned (arm_global_pd (arch_state sa)) (obj_bits (the (kheap sa (arm_global_pd (arch_state sa)))))\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) (?sz102 sa i x ao)
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 2 ^ arch_kobj_size ao - 1 < 2 ^ ?sz102 sa i x ao
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 5. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 6. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 7. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 8. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (7 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); is_aligned (arm_global_pd (arch_state sa)) (obj_bits (the (kheap sa (arm_global_pd (arch_state sa)))))\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) (?sz102 sa i x ao)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 2 ^ arch_kobj_size ao - 1 < 2 ^ ?sz102 sa i x ao
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 5. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 7. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 2 ^ arch_kobj_size ao - 1 < 2 ^ arch_kobj_size ao
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 5. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> arch_kobj_size ao < LENGTH(32)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<noteq> {}
 4. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 5. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa i x ao x1. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (ASIDPool x1)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; \<forall>x\<in>ran x1. typ_at (AArch APageDirectory) x sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (ASIDPool x1)); empty_table (set (second_level_tables (arch_state sa))) (ArchObj (ASIDPool x1)); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; ao = ASIDPool x1\<rbrakk> \<Longrightarrow> pageBits < 32
 2. \<And>sa i x ao x41 x42. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (DataPage x41 x42)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (DataPage x41 x42)); empty_table (set (second_level_tables (arch_state sa))) (ArchObj (DataPage x41 x42)); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; ao = DataPage x41 x42\<rbrakk> \<Longrightarrow> pageBitsForSize x42 < 32
 3. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<notin> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 5. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i x ao x41 x42. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (DataPage x41 x42)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj (DataPage x41 x42)); empty_table (set (second_level_tables (arch_state sa))) (ArchObj (DataPage x41 x42)); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; ao = DataPage x41 x42\<rbrakk> \<Longrightarrow> pageBitsForSize x42 < 32
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<notin> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<notin> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<notin> up_aligned_area p sz; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> ArchObj ao = default_object type dev o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<in> up_aligned_area p sz
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x \<in> {0..<num}; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<in> {p + word_of_nat x * 2 ^ obj_bits_api type o_bits..p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)}
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> p + word_of_nat x * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat x * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) (?sz134 sa i x ao)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> 2 ^ obj_bits_api type o_bits - 1 < 2 ^ ?sz134 sa i x ao
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> is_aligned p (obj_bits_api type o_bits)
 2. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> 2 ^ obj_bits_api type o_bits - 1 < 2 ^ obj_bits_api type o_bits
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> 2 ^ obj_bits_api type o_bits - 1 < 2 ^ obj_bits_api type o_bits
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i x ao. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; kheap s (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); arm_global_pd (arch_state sa) = p + word_of_nat x * 2 ^ obj_bits_api type o_bits; x < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vspace_obj ao sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (p + word_of_nat x * 2 ^ obj_bits_api type o_bits) = Some (ArchObj ao); empty_table (set (second_level_tables (arch_state sa))) (ArchObj ao); valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> obj_bits_api type o_bits < LENGTH(32)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> idle_equiv s (sa\<lparr>kheap := \<lambda>a. if a \<in> (\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num} then Some (default_object type dev o_bits) else kheap sa a\<rparr>)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); pspace_no_overlap (up_aligned_area p sz) sa\<rbrakk> \<Longrightarrow> \<forall>a\<in>(\<lambda>x. ptr_add p (x * 2 ^ obj_bits_api type o_bits)) ` {0..<num}. a \<noteq> idle_thread sa
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); \<forall>x ko. kheap sa x = Some ko \<longrightarrow> {x..x + (2 ^ obj_bits ko - 1)} \<inter> up_aligned_area p sz = {}; a \<in> {0..<num}; ptr_add p (a * 2 ^ obj_bits_api type o_bits) = idle_thread sa\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; ptr_add p (a * 2 ^ obj_bits_api type o_bits) = idle_thread sa; \<forall>ko. kheap sa (idle_thread sa) = Some ko \<longrightarrow> {idle_thread sa..idle_thread sa + (2 ^ obj_bits ko - 1)} \<inter> up_aligned_area p sz = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> a < num
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> num \<noteq> 0
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> False
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> num \<noteq> 0
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> False
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}\<rbrakk> \<Longrightarrow> num \<noteq> 0
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..(p && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> False
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p + word_of_nat a * 2 ^ obj_bits_api type o_bits..p + word_of_nat a * 2 ^ obj_bits_api type o_bits + 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> {p..(p && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; {idle_thread_ptr..idle_thread_ptr + 0x1FF} \<inter> up_aligned_area p sz = {}; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> is_aligned idle_thread_ptr (?sz202 sa i a tcb koa)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 0x1FF < 2 ^ ?sz202 sa i a tcb koa
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 4. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 5. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; \<forall>x\<in>dom (kheap sa). is_aligned x (obj_bits (the (kheap sa x))); pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa)\<rbrakk> \<Longrightarrow> is_aligned idle_thread_ptr (?sz202 sa i a tcb koa)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 0x1FF < 2 ^ ?sz202 sa i a tcb koa
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 4. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 5. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (7 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa)\<rbrakk> \<Longrightarrow> idle_thread sa \<in> dom (kheap sa)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); is_aligned (idle_thread sa) (obj_bits (the (kheap sa (idle_thread sa))))\<rbrakk> \<Longrightarrow> is_aligned idle_thread_ptr (?sz202 sa i a tcb koa)
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 0x1FF < 2 ^ ?sz202 sa i a tcb koa
 4. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 5. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 6. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 7. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (6 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; valid_objs sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); is_aligned (idle_thread sa) (obj_bits (the (kheap sa (idle_thread sa))))\<rbrakk> \<Longrightarrow> is_aligned idle_thread_ptr (?sz202 sa i a tcb koa)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 0x1FF < 2 ^ ?sz202 sa i a tcb koa
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 4. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 5. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 6. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (5 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> 0x1FF < 2 ^ 9
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 4. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 5. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (4 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> {idle_thread_ptr} \<noteq> {}
 3. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; \<not> {idle_thread_ptr} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 4. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1}; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; idle_thread_ptr \<notin> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; idle_thread_ptr \<notin> up_aligned_area p sz; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> False
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz; {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<in> up_aligned_area p sz
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a \<in> {0..<num}; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; {p..p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1} \<subseteq> up_aligned_area p sz\<rbrakk> \<Longrightarrow> idle_thread_ptr \<in> {idle_thread_ptr..idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)}
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; p + word_of_nat a * 2 ^ obj_bits_api type o_bits = idle_thread_ptr; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> idle_thread_ptr \<le> idle_thread_ptr + (2 ^ obj_bits_api type o_bits - 1)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> p + word_of_nat a * 2 ^ obj_bits_api type o_bits \<le> p + word_of_nat a * 2 ^ obj_bits_api type o_bits + (2 ^ obj_bits_api type o_bits - 1)
 2. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> is_aligned (p + word_of_nat a * 2 ^ obj_bits_api type o_bits) (?sz230 sa i a tcb koa)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> 2 ^ obj_bits_api type o_bits - 1 < 2 ^ ?sz230 sa i a tcb koa
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (3 subgoals):
 1. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> is_aligned p (obj_bits_api type o_bits)
 2. \<And>sa i a tcb koa. \<lbrakk>range_cover p sz (obj_bits_api type o_bits) num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = Some koa; cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa)); a < num; valid_pspace sa; valid_mdb sa; valid_ioc sa; idle_thread sa = idle_thread_ptr; kheap sa idle_thread_ptr = Some (TCB tcb); only_idle sa; if_unsafe_then_cap sa; idle (tcb_state tcb); valid_reply_caps sa; tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_arch_caps sa; valid_vso_at (arm_global_pd (arch_state sa)) sa; \<forall>p\<in>set (arm_global_pts (arch_state sa)). \<exists>pt. kheap sa p = Some (ArchObj (PageTable pt)) \<and> (\<forall>x. aligned_pte (pt x)); kheap sa (arm_global_pd (arch_state sa)) = Some koa; empty_table (set (second_level_tables (arch_state sa))) koa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; p \<le> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<longrightarrow> p + word_of_nat num * 2 ^ obj_bits_api type o_bits - 1 \<le> (p && ~~ mask sz) + (2 ^ sz - 1)\<rbrakk> \<Longrightarrow> 2 ^ obj_bits_api type o_bits - 1 < 2 ^ obj_bits_api type o_bits
 3. \<And>sa i. \<lbrakk>invs sa; range_cover p sz (obj_bits_api type o_bits) num; 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal (1 subgoal):
 1. \<And>sa i. \<lbrakk>invs sa; is_aligned p (obj_bits_api type o_bits) \<and> sz < 32 \<and> obj_bits_api type o_bits \<le> sz \<and> num + unat (p && mask sz >> obj_bits_api type o_bits) \<le> 2 ^ (sz - obj_bits_api type o_bits); 0 < num; cte_wp_at (\<lambda>c. c = UntypedCap dev (p && ~~ mask sz) sz i) slot sa; i \<le> unat (p && mask sz) \<or> pspace_no_overlap (up_aligned_area p sz) sa; type \<noteq> Untyped; arm_global_pd (arch_state s) = arm_global_pd (arch_state sa); kheap s (arm_global_pd (arch_state sa)) = kheap sa (arm_global_pd (arch_state sa)); cur_thread sa \<noteq> idle_thread s \<longrightarrow> exclusive_state (machine_state s) = exclusive_state (machine_state sa); idle_equiv s sa; cur_thread s = cur_thread sa; dom (device_state (machine_state s)) = dom (device_state (machine_state sa))\<rbrakk> \<Longrightarrow> pspace_no_overlap (up_aligned_area p sz) sa proof (prove)
goal:
No subgoals!