theory Retype_C

lemma memzero_spec:
  "\<forall>s. \<Gamma> \<turnstile> \<lbrace>s. ptr_val \<acute>s \<noteq> 0 \<and> ptr_val \<acute>s \<le> ptr_val \<acute>s + (\<acute>n - 1)
         \<and> (is_aligned (ptr_val \<acute>s) 2) \<and> (is_aligned (\<acute>n) 2)
         \<and> {ptr_val \<acute>s ..+ unat \<acute>n} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd \<acute>t_hrs)
         \<and> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state \<in> insert 0 {\<acute>n ..}\<rbrace>
    Call memzero_'proc {t.
     t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val (s_' s))
                                            (replicate (unat (n_' s)) (ucast (0)))) (t_hrs_' (globals s))}" apply (hoare_rule HoarePartial.ProcNoRec1) apply (clarsimp simp: whileAnno_def) apply (rule_tac I1="{t. (ptr_val (s_' s) \<le> ptr_val (s_' s) + ((n_' s) - 1) \<and> ptr_val (s_' s) \<noteq> 0) \<and>
                             ptr_val (s_' s) + (n_' s - n_' t) = ptr_val (p___ptr_to_unsigned_char_' t) \<and>
                             n_' t \<le> n_' s \<and>
                             (is_aligned (n_' t) 2) \<and>
                             (is_aligned (n_' s) 2) \<and>
                             (is_aligned (ptr_val (s_' t)) 2) \<and>
                             (is_aligned (ptr_val (s_' s)) 2) \<and>
                             (is_aligned (ptr_val (p___ptr_to_unsigned_char_' t)) 2) \<and>
                             {ptr_val (p___ptr_to_unsigned_char_' t) ..+ unat (n_' t)} \<times> {SIndexVal, SIndexTyp 0}
                                 \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and>
                             globals t = (globals s)\<lparr> t_hrs_' :=
                             hrs_mem_update (heap_update_list (ptr_val (s_' s))
                                               (replicate (unat (n_' s - n_' t)) 0))
                                                      (t_hrs_' (globals s))\<rparr> }"
            and V1=undefined in subst [OF whileAnno_def]) apply vcg apply (clarsimp simp add: hrs_mem_update_def) apply clarsimp apply (case_tac s, case_tac p___ptr_to_unsigned_char) apply (subgoal_tac "4 \<le> unat na") apply (intro conjI) apply (simp add: ptr_safe_def s_footprint_def s_footprint_untyped_def
                            typ_uinfo_t_def typ_info_word) apply (erule order_trans[rotated]) apply (auto intro!: intvlI)[1] apply (subst c_guard_word32, simp_all)[1] apply (clarsimp simp: field_simps) apply (metis le_minus' word_leq_minus_one_le olen_add_eqv diff_self word_le_0_iff word_le_less_eq) apply (clarsimp simp: field_simps) apply (frule is_aligned_and_not_zero) apply clarsimp apply (rule word_le_imp_diff_le, auto)[1] apply clarsimp apply (rule aligned_sub_aligned [where n=2], simp_all add: is_aligned_def word_bits_def)[1] apply clarsimp apply (rule is_aligned_add, simp_all add: is_aligned_def word_bits_def)[1] apply (erule order_trans[rotated]) apply (clarsimp simp: subset_iff) apply (erule subsetD[OF intvl_sub_offset, rotated]) apply (simp add: unat_sub word_le_nat_alt) apply (clarsimp simp: word_bits_def hrs_mem_update_def) apply (subst heap_update_word32_is_heap_update_list [where a="[]"]) apply (subst heap_update_list_append3[symmetric]) apply clarsimp apply (subst to_bytes_word32_0) apply (rule heap_update_list_replicate) apply clarsimp apply (rule_tac s="unat ((n - na) + 4)" in trans) apply (simp add: field_simps) apply (subst Word.unat_plus_simple[THEN iffD1]) apply (rule is_aligned_no_overflow''[where n=2, simplified]) apply (erule(1) aligned_sub_aligned, simp) apply (clarsimp simp: field_simps) apply (frule_tac x=n in is_aligned_no_overflow'', simp) apply simp apply simp apply (rule dvd_imp_le) apply (simp add: is_aligned_def) apply (simp add: unat_eq_0[symmetric]) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>s. \<Gamma>\<turnstile> \<lbrace>s. ptr_val \<acute>s \<noteq> 0 \<and> ptr_val \<acute>s \<le> ptr_val \<acute>s + (\<acute>n - 1) \<and> is_aligned (ptr_val \<acute>s) 2 \<and> is_aligned \<acute>n 2 \<and> {ptr_val \<acute>s..+unat \<acute>n} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state \<in> insert 0 {\<acute>n..}\<rbrace> Call memzero_'proc \<lbrace>\<acute>t_hrs = hrs_mem_update (heap_update_list (ptr_val \<^bsup>s\<^esup>s) (replicate (unat \<^bsup>s\<^esup>n) (UCAST('a \<rightarrow> 8) 0))) \<^bsup>s\<^esup>t_hrs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<forall>s. \<Gamma>\<turnstile> \<lbrace>s. ptr_val \<acute>s \<noteq> 0 \<and> ptr_val \<acute>s \<le> ptr_val \<acute>s + (\<acute>n - 1) \<and> is_aligned (ptr_val \<acute>s) 2 \<and> is_aligned \<acute>n 2 \<and> {ptr_val \<acute>s..+unat \<acute>n} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state \<in> insert 0 {\<acute>n..}\<rbrace> TRY
  \<acute>p___ptr_to_unsigned_char :== PTR_COERCE(unit \<rightarrow> 8 word) \<acute>s;;
SKIP;;
SKIP;;
Guard GhostStateError \<lbrace>fst (gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state, id)\<rbrace> (\<acute>globals :== ghost'state_'_update (snd (gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state, id)));;
WHILE \<acute>n \<noteq> SCAST(32 signed \<rightarrow> 32) 0 DO
  Guard C_Guard \<lbrace>ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) (hrs_htd \<acute>t_hrs) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) (SCAST(32 signed \<rightarrow> 32) 0))));;
Guard MemorySafety \<lbrace>ptr_add_assertion' \<acute>p___ptr_to_unsigned_char (uint (word_of_int (int (size_of TYPE(32 word))))) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>p___ptr_to_unsigned_char :== \<acute>p___ptr_to_unsigned_char +\<^sub>p uint (word_of_int (int (size_of TYPE(32 word)))));;
\<acute>n :== \<acute>n - UCAST(32 \<rightarrow> 32) (word_of_int (int (size_of TYPE(32 word))))
OD
CATCH SKIP
END \<lbrace>\<acute>t_hrs = hrs_mem_update (heap_update_list (ptr_val \<^bsup>s\<^esup>s) (replicate (unat \<^bsup>s\<^esup>n) (UCAST('a \<rightarrow> 8) 0))) \<^bsup>s\<^esup>t_hrs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<Gamma>\<turnstile> \<lbrace>s. ptr_val \<acute>s \<noteq> 0 \<and> ptr_val \<acute>s \<le> ptr_val \<acute>s + (\<acute>n - 1) \<and> is_aligned (ptr_val \<acute>s) 2 \<and> is_aligned \<acute>n 2 \<and> {ptr_val \<acute>s..+unat \<acute>n} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> (gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state)\<rbrace> TRY
  \<acute>p___ptr_to_unsigned_char :== PTR_COERCE(unit \<rightarrow> 8 word) \<acute>s;;
SKIP;;
SKIP;;
Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
While \<lbrace>\<acute>n \<noteq> 0\<rbrace> (Guard C_Guard \<lbrace>ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) (hrs_htd \<acute>t_hrs) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) 0)));;
Guard MemorySafety UNIV (\<acute>p___ptr_to_unsigned_char :== \<acute>p___ptr_to_unsigned_char +\<^sub>p 4);;
\<acute>n :== \<acute>n - 4)
CATCH SKIP
END \<lbrace>\<acute>t_hrs = hrs_mem_update (heap_update_list (ptr_val \<^bsup>s\<^esup>s) (replicate (unat \<^bsup>s\<^esup>n) 0)) \<^bsup>s\<^esup>t_hrs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<Gamma>\<turnstile> \<lbrace>s. ptr_val \<acute>s \<noteq> 0 \<and> ptr_val \<acute>s \<le> ptr_val \<acute>s + (\<acute>n - 1) \<and> is_aligned (ptr_val \<acute>s) 2 \<and> is_aligned \<acute>n 2 \<and> {ptr_val \<acute>s..+unat \<acute>n} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd \<acute>t_hrs) \<and> (gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state)\<rbrace> TRY
  \<acute>p___ptr_to_unsigned_char :== PTR_COERCE(unit \<rightarrow> 8 word) \<acute>s;;
SKIP;;
SKIP;;
Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>n \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
WHILE \<acute>n \<noteq> 0
INV {t. (ptr_val (s_' s) \<le> ptr_val (s_' s) + (n_' s - 1) \<and> ptr_val (s_' s) \<noteq> 0) \<and> ptr_val (s_' s) + (n_' s - n_' t) = ptr_val (p___ptr_to_unsigned_char_' t) \<and> n_' t \<le> n_' s \<and> is_aligned (n_' t) 2 \<and> is_aligned (n_' s) 2 \<and> is_aligned (ptr_val (s_' t)) 2 \<and> is_aligned (ptr_val (s_' s)) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char_' t)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char_' t)..+unat (n_' t)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> globals t = globals s\<lparr>t_hrs_' := hrs_mem_update (heap_update_list (ptr_val (s_' s)) (replicate (unat (n_' s - n_' t)) 0)) (t_hrs_' (globals s))\<rparr>}
DO
  Guard C_Guard \<lbrace>ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) (hrs_htd \<acute>t_hrs) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) \<acute>p___ptr_to_unsigned_char) 0)));;
Guard MemorySafety UNIV (\<acute>p___ptr_to_unsigned_char :== \<acute>p___ptr_to_unsigned_char +\<^sub>p 4);;
\<acute>n :== \<acute>n - 4
OD
CATCH SKIP
END \<lbrace>\<acute>t_hrs = hrs_mem_update (heap_update_list (ptr_val \<^bsup>s\<^esup>s) (replicate (unat \<^bsup>s\<^esup>n) 0)) \<^bsup>s\<^esup>t_hrs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n. \<lbrakk>ptr_val s \<noteq> 0; ptr_val s \<le> ptr_val s + (n - 1); is_aligned (ptr_val s) 2; is_aligned n 2; {ptr_val s..+unat n} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrs); ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>a. snd (snd a)) ghost'state = 0 \<or> n \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>a. snd (snd a)) ghost'state\<rbrakk> \<Longrightarrow> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) ghost'state = 0 \<or> n \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) ghost'state) \<and> ptr_val s \<le> ptr_val s + (n - 1) \<and> ptr_val s \<noteq> 0 \<and> ptr_val s + (n - n) = ptr_val (PTR_COERCE(unit \<rightarrow> 8 word) s) \<and> n \<le> n \<and> is_aligned n 2 \<and> is_aligned n 2 \<and> is_aligned (ptr_val s) 2 \<and> is_aligned (ptr_val s) 2 \<and> is_aligned (ptr_val (PTR_COERCE(unit \<rightarrow> 8 word) s)) 2 \<and> {ptr_val (PTR_COERCE(unit \<rightarrow> 8 word) s)..+unat n} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrs) \<and> \<lparr>t_hrs_' = t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = id ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - n)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; na \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd t_hrsa) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) \<and> ptr_val s \<le> ptr_val s + (n - 1) \<and> ptr_val s \<noteq> 0 \<and> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4) \<and> na - 4 \<le> n \<and> is_aligned (na - 4) 2 \<and> is_aligned n 2 \<and> is_aligned (ptr_val sa) 2 \<and> is_aligned (ptr_val s) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd (hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) t_hrsa)) \<and> \<lparr>t_hrs_' = hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (2 subgoals):
 1. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; na \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd t_hrsa) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) \<and> ptr_val s \<le> ptr_val s + (n - 1) \<and> ptr_val s \<noteq> 0 \<and> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4) \<and> na - 4 \<le> n \<and> is_aligned (na - 4) 2 \<and> is_aligned n 2 \<and> is_aligned (ptr_val sa) 2 \<and> is_aligned (ptr_val s) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd (hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) t_hrsa)) \<and> \<lparr>t_hrs_' = hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (2 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd (a, b)) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) \<and> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4) \<and> na - 4 \<le> n \<and> is_aligned (na - 4) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)) \<and> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (2 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd (a, b)) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) \<and> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4) \<and> na - 4 \<le> n \<and> is_aligned (na - 4) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)) \<and> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd (a, b)) \<and> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) \<and> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4) \<and> na - 4 \<le> n \<and> is_aligned (na - 4) 2 \<and> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2 \<and> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)) \<and> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (10 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_safe (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) (hrs_htd (a, b))
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 9. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 10. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (10 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; x + (n - na) = xa; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned xa 2; {xa..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {(xa + word_of_nat x, k) |x k. x < 4 \<and> (k = SIndexVal \<or> k = SIndexTyp 0)} \<subseteq> dom_s (hrs_htd (a, b))
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 9. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 10. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (10 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; x + (n - na) = xa; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned xa 2; (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {(xa + word_of_nat x, k) |x k. x < 4 \<and> (k = SIndexVal \<or> k = SIndexTyp 0)} \<subseteq> {xa..+unat na} \<times> {SIndexVal, SIndexTyp 0}
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 9. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 10. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (9 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> c_guard (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char)
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 9. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (9 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; x + (n - na) = xa; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned xa 2; {xa..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> xa \<noteq> 0
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 9. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (9 subgoals):
 1. \<And>a b n aa ba sa x. \<lbrakk>x \<le> n + x - 1; x \<noteq> 0; n + x \<le> n; is_aligned (n + x) 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; {0..+unat (n + x)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (- x)) 0)) (a, b); n + x \<noteq> 0; 4 \<le> unat (n + x)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 8. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 9. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (8 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val s + (n - (na - 4)) = ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 8. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (7 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 7. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (8 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> na \<noteq> 0
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na; 2\<^sup>2 \<le> na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 7. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 8. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (7 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na; 2\<^sup>2 \<le> na\<rbrakk> \<Longrightarrow> na - 4 \<le> n
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 6. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 7. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (6 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 6. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (6 subgoals):
 1. \<And>a b n aa ba sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (na - 4) 2
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 5. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 6. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (5 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)) 2
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 5. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (5 subgoals):
 1. \<And>a b n aa ba sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (x + (n - na) + 4) 2
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 5. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b))
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> {ptr_val (p___ptr_to_unsigned_char +\<^sub>p 4)..+unat (na - 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0}
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n aa ba sa na x ab bb. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; 4 \<le> unat na; ab \<in> {x + (n - na) + 4..+unat (na - 4)}; bb = SIndexVal \<or> bb = SIndexTyp 0\<rbrakk> \<Longrightarrow> ab \<in> {x + (n - na)..+unat na}
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n aa ba sa na x ab bb. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; (aa, ba) = hrs_mem_update (heap_update_list x (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; 4 \<le> unat na; bb = SIndexVal \<or> bb = SIndexTyp 0\<rbrakk> \<Longrightarrow> unat 4 + unat (na - 4) \<le> unat na
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa; 4 \<le> unat na\<rbrakk> \<Longrightarrow> hrs_mem_update (heap_update (PTR_COERCE(8 word \<rightarrow> 32 word) p___ptr_to_unsigned_char) 0) (hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b)) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - (na - 4))) 0)) (a, b)
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> heap_update (PTR(32 word) (x + (n - na))) 0 (heap_update_list x (replicate (unat (n - na)) 0) a) = heap_update_list x (replicate (unat (n - (na - 4))) 0) a
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> heap_update_list (ptr_val (PTR(32 word) (x + (n - na)))) (to_bytes 0 []) (heap_update_list x (replicate (unat (n - na)) 0) a) = heap_update_list x (replicate (unat (n - (na - 4))) 0) a
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> ptr_val (PTR(32 word) (x + (n - na))) = x + word_of_nat (length (replicate (unat (n - na)) 0))
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> heap_update_list x (replicate (unat (n - na)) 0 @ to_bytes 0 []) a = heap_update_list x (replicate (unat (n - (na - 4))) 0) a
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> heap_update_list x (replicate (unat (n - na)) 0 @ to_bytes 0 []) a = heap_update_list x (replicate (unat (n - (na - 4))) 0) a
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> heap_update_list x (replicate (unat (n - na)) 0 @ [0, 0, 0, 0]) a = heap_update_list x (replicate (unat (n - (na - 4))) 0) a
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> set [0, 0, 0, 0] = {0}
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - (na - 4)) = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - (na - 4)) = unat (n - na) + length [0, 0, 0, 0]
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - (na - 4)) = unat (n - na + 4)
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na + 4) = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na + 4) = unat (n - na) + length [0, 0, 0, 0]
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> n - na \<le> n - na + 4
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (5 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> is_aligned (n - na) 2
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> n - na + 4 \<noteq> 0
 3. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 4. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 5. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> n - na + 4 \<noteq> 0
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa x. \<lbrakk>x \<le> n + x - 1; x \<noteq> 0; n + 4 \<le> n; is_aligned (n + 4) 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x - 4) 2; {x - 4..+unat (n + 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); n + 4 \<noteq> 0; 4 \<le> unat (n + 4)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (4 subgoals):
 1. \<And>a b n sa x. \<lbrakk>x \<le> n + x - 1; x \<noteq> 0; n + 4 \<le> n; is_aligned (n + 4) 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x - 4) 2; {x - 4..+unat (n + 4)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); n + 4 \<noteq> 0; 4 \<le> unat (n + 4); n \<le> n + 2\<^sup>2\<rbrakk> \<Longrightarrow> False
 2. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 3. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 4. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b n sa na x. \<lbrakk>x \<le> x + (n - 1); x \<noteq> 0; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned x 2; is_aligned (x + (n - na)) 2; {x + (n - na)..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); na \<noteq> 0; 4 \<le> unat na\<rbrakk> \<Longrightarrow> unat (n - na) + unat 4 = unat (n - na) + length [0, 0, 0, 0]
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (2 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 \<le> unat na
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (3 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 4 dvd unat na
 2. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 0 < unat na
 3. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (2 subgoals):
 1. \<And>a b s n aa ba sa p___ptr_to_unsigned_char na x xa. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (a, b)); (aa, ba) = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) (a, b); na \<noteq> 0; s = PTR(unit) x; p___ptr_to_unsigned_char = PTR(8 word) xa\<rbrakk> \<Longrightarrow> 0 < unat na
 2. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal (1 subgoal):
 1. \<And>t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more s n t_hrsa phantom_machine_statea ghost'statea avail_rega ksNumCPUsa ndks_boota active_irqa rootservera ksCurDomaina ksCurThreada ksDomainTimea ksIdleThreada tlbLockCounta armKSNextASIDa current_faulta ksReadyQueuesa armKSASIDTablea rootserver_mema armKSHWASIDTablea intStateIRQTablea ksDomScheduleIdxa ksSchedulerActiona current_extra_capsa isFPUEnabledCacheda current_lookup_faulta ksWorkUnitsCompleteda current_syscall_errora ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa morea sa p___ptr_to_unsigned_char na. \<lbrakk>ptr_val s \<le> ptr_val s + (n - 1); ptr_val s \<noteq> 0; ptr_val s + (n - na) = ptr_val p___ptr_to_unsigned_char; na \<le> n; is_aligned na 2; is_aligned n 2; is_aligned (ptr_val sa) 2; is_aligned (ptr_val s) 2; is_aligned (ptr_val p___ptr_to_unsigned_char) 2; {ptr_val p___ptr_to_unsigned_char..+unat na} \<times> insert SIndexVal (Collect ((=) (SIndexTyp 0))) \<subseteq> dom_s (hrs_htd t_hrsa); \<lparr>t_hrs_' = t_hrsa, phantom_machine_state_' = phantom_machine_statea, ghost'state_' = ghost'statea, avail_reg_' = avail_rega, ksNumCPUs_' = ksNumCPUsa, ndks_boot_' = ndks_boota, active_irq_' = active_irqa, rootserver_' = rootservera, ksCurDomain_' = ksCurDomaina, ksCurThread_' = ksCurThreada, ksDomainTime_' = ksDomainTimea, ksIdleThread_' = ksIdleThreada, tlbLockCount_' = tlbLockCounta, armKSNextASID_' = armKSNextASIDa, current_fault_' = current_faulta, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTablea, rootserver_mem_' = rootserver_mema, armKSHWASIDTable_' = armKSHWASIDTablea, intStateIRQTable_' = intStateIRQTablea, ksDomScheduleIdx_' = ksDomScheduleIdxa, ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_capsa, isFPUEnabledCached_' = isFPUEnabledCacheda, current_lookup_fault_' = current_lookup_faulta, ksWorkUnitsCompleted_' = ksWorkUnitsCompleteda, current_syscall_error_' = current_syscall_errora, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa, \<dots> = morea\<rparr> = \<lparr>t_hrs_' = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat (n - na)) 0)) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>; \<not> na \<noteq> 0\<rbrakk> \<Longrightarrow> t_hrsa = hrs_mem_update (heap_update_list (ptr_val s) (replicate (unat n) 0)) t_hrs proof (prove)
goal:
No subgoals!