theory Retype_C

lemma ccorres_placeNewObject_tcb:
  "ccorresG rf_sr \<Gamma> dc xfdc
   (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits
      and valid_queues and (\<lambda>s. sym_refs (state_refs_of' s))
      and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s)
      and ret_zero regionBase (2 ^ tcbBlockSizeBits)
      and K (regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits 1
      \<and>  {regionBase..+2^tcbBlockSizeBits} \<inter> kernel_data_refs = {}))
   ({s. region_actually_is_zero_bytes regionBase (2^tcbBlockSizeBits) s})
    hs
   (placeNewObject regionBase (makeObject :: tcb) 0)
   (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
        (global_htd_update (\<lambda>s. ptr_retyp (Ptr (ptr_val (tcb_' s) - ctcb_offset) :: (cte_C[5]) ptr)
            \<circ> ptr_retyp (tcb_' s)));;
        (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>tcb\<rbrace>
           (call (\<lambda>s. s\<lparr>context_' := Ptr &((Ptr &(tcb_' s\<rightarrow>[''tcbArch_C'']) :: arch_tcb_C ptr)\<rightarrow>[''tcbContext_C''])\<rparr>) Arch_initContext_'proc (\<lambda>s t. s\<lparr>globals := globals t\<rparr>) (\<lambda>s' s''. Basic (\<lambda>s. s))));;
        (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>tcb\<rbrace>
           (Basic (\<lambda>s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (Ptr &((tcb_' s)\<rightarrow>[''tcbTimeSlice_C''])) (5::word32)))) s))))" apply - apply (rule ccorres_from_vcg_nofail) apply clarsimp apply (rule conseqPre) apply vcg apply (clarsimp simp: rf_sr_htd_safe ctcb_offset_defs) apply (subgoal_tac "c_guard (tcb_Ptr (regionBase + 0x100))") apply (subgoal_tac "hrs_htd (hrs_htd_update (ptr_retyp (Ptr regionBase :: (cte_C[5]) ptr)
                                 \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100)))
                  (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)") prefer 2 apply (clarsimp simp: hrs_htd_update) apply (rule h_t_valid_ptr_retyps_gen_disjoint[where n=1 and arr=False,
                unfolded ptr_retyps_gen_def, simplified]) apply (rule ptr_retyp_h_t_valid) apply simp apply (rule tcb_ptr_orth_cte_ptrs') apply (intro conjI allI impI) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                               kernel_data_refs_domain_eq_rotate) apply (intro ptr_retyps_htd_safe_neg ptr_retyp_htd_safe_neg, simp_all add: size_of_def)[1] apply (erule disjoint_subset[rotated]) apply (rule intvl_sub_offset, simp add: objBits_defs) apply (erule disjoint_subset[rotated],
                simp add: intvl_start_le size_td_array cte_C_size objBits_defs) apply (clarsimp simp: hrs_htd_update) apply (clarsimp simp: CPSR_def word_sle_def)+ apply (clarsimp simp: hrs_htd_update) apply (rule h_t_valid_field[rotated], simp+)+ apply (clarsimp simp: hrs_htd_update) apply (clarsimp simp: hrs_htd_update) apply (rule bexI [OF _ placeNewObject_eq]) apply (clarsimp simp: split_def new_cap_addrs_def) apply (cut_tac \<sigma>=\<sigma> and x=x
                   and ks="ksPSpace \<sigma>" and p="tcb_Ptr (regionBase + 0x100)" in cnc_tcb_helper) apply clarsimp apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs
                                         objBitsKO_def range_cover.aligned) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs objBitsKO_def) apply (simp add:olen_add_eqv[symmetric] ctcb_size_bits_def) apply (erule is_aligned_no_wrap'[OF range_cover.aligned]) apply (simp add: objBits_defs) apply simp apply clarsimp apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs objBitsKO_def) apply (clarsimp) apply simp apply clarsimp apply (clarsimp simp: objBits_simps ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs) apply (frule region_actually_is_bytes) apply (clarsimp simp: region_is_bytes'_def ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs split_def
                               hrs_mem_update_def hrs_htd_def) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs hrs_mem_update_def split_def) apply (simp add: hrs_mem_def) apply (simp add: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs hrs_mem_update_def split_def) apply (clarsimp simp: rf_sr_def ptr_retyps_gen_def cong: Kernel_C.globals.unfold_congs
                            StateSpace.state.unfold_congs kernel_state.unfold_congs) apply (clarsimp simp: word_bits_def) apply (clarsimp simp: objBitsKO_def range_cover.aligned) apply (clarsimp simp: no_fail_def) apply (rule c_guard_tcb) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs range_cover.aligned) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits 1 \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {})) {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} hs (placeNewObject regionBase makeObject 0) (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain ((ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)))) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits 1 \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {})) {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} hs (placeNewObject regionBase makeObject 0) (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain ((ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)))) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits 1 \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {})) \<sigma> \<and> s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain ((ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> {s. pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma> \<and> pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma> \<and> Invariants_H.valid_queues \<sigma> \<and> sym_refs (state_refs_of' \<sigma>) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma> \<and> valid_objs' \<sigma> \<and> untyped_ranges_zero' \<sigma> \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma> \<and> regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (\<sigma>, s) \<in> rf_sr} \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>x\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr)} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> (?P'9 \<sigma>) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>x\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr)}
 2. \<And>\<sigma>. {s. pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma> \<and> pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma> \<and> Invariants_H.valid_queues \<sigma> \<and> sym_refs (state_refs_of' \<sigma>) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma> \<and> valid_objs' \<sigma> \<and> untyped_ranges_zero' \<sigma> \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma> \<and> regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'9 \<sigma> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. {s. pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma> \<and> pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma> \<and> Invariants_H.valid_queues \<sigma> \<and> sym_refs (state_refs_of' \<sigma>) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma> \<and> valid_objs' \<sigma> \<and> untyped_ranges_zero' \<sigma> \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma> \<and> regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> 0 \<le>s 8 \<and> unat 1 * 2 ^ unat 8 < 2 ^ 31 \<and> 0 \<le>s 1 \<and> 0 \<le>s 6 \<and> unat 1 * 2 ^ unat 6 < 2 ^ 31 \<and> 0 \<le>s 1 \<and> hrs_htd (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). (\<sigma>', s\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) x))) (globals s)\<rparr>) \<in> rf_sr))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> ptr_span (tcb_Ptr (regionBase + 0x100)) \<inter> ptr_span (PTR(cte_C[5]) regionBase) = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> ptr_span (tcb_Ptr (regionBase + 0x100)) \<inter> ptr_span (PTR(cte_C[5]) regionBase) = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100))\<rbrakk> \<Longrightarrow> ptr_span (tcb_Ptr (regionBase + 0x100)) \<inter> ptr_span (PTR(cte_C[5]) regionBase) = {}
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x))))) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> Kernel_C.CPSR <s 0x14 \<and> 0 \<le>s Kernel_C.CPSR \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<and> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<and> (\<not> snd (placeNewObject regionBase makeObject 0 \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> {regionBase + 0x100..+152} \<inter> kernel_data_refs = {}
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> {regionBase..+size_td (typ_info_t TYPE(cte_C[5]))} \<inter> kernel_data_refs = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> {regionBase + 0x100..+152} \<subseteq> {regionBase..+2 ^ tcbBlockSizeBits}
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> {regionBase..+size_td (typ_info_t TYPE(cte_C[5]))} \<inter> kernel_data_refs = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> {regionBase..+size_td (typ_info_t TYPE(cte_C[5]))} \<inter> kernel_data_refs = {}
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> Kernel_C.CPSR <s 0x14
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> 0 \<le>s Kernel_C.CPSR
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) regionBase) \<circ> ptr_retyp (tcb_Ptr (regionBase + 0x100))) (t_hrs_' (globals x))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (placeNewObject regionBase makeObject 0 \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (injectKOS makeObject)) (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) (ksPSpace \<sigma>)\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (19 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>, x) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<noteq> 0
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 2 ^ ctcb_size_bits \<le> ptr_val (tcb_Ptr (regionBase + 0x100))
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<noteq> 0
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 2 ^ ctcb_size_bits \<le> ptr_val (tcb_Ptr (regionBase + 0x100))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<noteq> 0
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 2 ^ ctcb_size_bits \<le> ptr_val (tcb_Ptr (regionBase + 0x100))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 2 ^ ctcb_size_bits \<le> ptr_val (tcb_Ptr (regionBase + 0x100))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> regionBase \<le> regionBase + 0x100
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0x100 < 2 ^ tcbBlockSizeBits
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues \<sigma>
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_aligned' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (objBitsKO (KOTCB makeObject)) (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> pspace_distinct' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := ksPSpace \<sigma>\<rparr>))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> dom (ksPSpace \<sigma>) \<subseteq> dom (ksPSpace \<sigma>)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 10. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ objBitsKO (KOTCB makeObject)}) \<sigma>
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 9. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); region_is_bytes regionBase (2 ^ tcbBlockSizeBits) x\<rbrakk> \<Longrightarrow> region_is_bytes (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) (2 ^ tcbBlockSizeBits) x
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 8. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) = replicate (2 ^ tcbBlockSizeBits) 0
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> heap_list (fst (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 7. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> {ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 6. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>xa. ptr_retyps_gen 1 (PTR(cte_C[5]) (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)))) False (ptr_retyps_gen 1 (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150)) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>); (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, globals_update (t_hrs_'_update (\<lambda>a. (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5 (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem a) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (fst (hrs_htd_update (\<lambda>xa. ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) regionBase) False (ptr_retyps_gen (Suc 0) (tcb_Ptr (regionBase + 0x100)) False xa)) a))), snd (hrs_htd_update (\<lambda>xa. ptr_retyps_gen (Suc 0) (PTR(cte_C[5]) regionBase) False (ptr_retyps_gen (Suc 0) (tcb_Ptr (regionBase + 0x100)) False xa)) a)))) x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(regionBase \<mapsto> KOTCB makeObject)\<rparr>, x\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>xa. (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5 (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) 0x150) (fst (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))), snd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) xa))) (globals x)\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 5. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> 0 < word_bits
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 4. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (0 + objBitsKO (injectKOS makeObject))
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 3. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr; c_guard (tcb_Ptr (regionBase + 0x100)); ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals x)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); \<not> snd (placeNewObject regionBase makeObject 0 \<sigma>)\<rbrakk> \<Longrightarrow> no_fail ((=) \<sigma>) (placeNewObject regionBase makeObject 0)
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> c_guard (tcb_Ptr (regionBase + 0x100)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> is_aligned (ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100))) tcbBlockSizeBits
 2. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; pspace_no_overlap' regionBase tcbBlockSizeBits \<sigma>; Invariants_H.valid_queues \<sigma>; sym_refs (state_refs_of' \<sigma>); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize \<sigma>; valid_objs' \<sigma>; untyped_ranges_zero' \<sigma>; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} \<sigma>; regionBase \<noteq> 0; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) x; heap_list (hrs_mem (t_hrs_' (globals x))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100)) \<noteq> 0 proof (prove)
goal:
No subgoals!