theory PageTableDuplicates

lemma copyGlobalMappings_ksPSpace_stable:
  notes blah[simp del] =  atLeastatMost_subset_iff atLeastLessThan_iff
          Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex
          atLeastAtMost_iff
  assumes ptr_al: "is_aligned ptr pdBits"
  shows
   "\<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and>
    is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace>
   copyGlobalMappings ptr
   \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}
           then ksPSpace s ((armKSGlobalPD (ksArchState s)) + (x && mask pdBits))
           else ko)\<rbrace>" proof - have not_aligned_eq_None:
      "\<And>x s. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s\<rbrakk> \<Longrightarrow> ksPSpace s x = None" apply (rule ccontr) apply clarsimp apply (drule(1) pspace_alignedD') apply (drule is_aligned_weaken[where y = 2]) apply (case_tac y, simp_all add: objBits_simps' pageBits_def) apply (simp add: archObjSize_def pageBits_def
                       pteBits_def pdeBits_def
                  split: arch_kernel_object.splits) done have ptr_eqD:
      "\<And>p a b. \<lbrakk>p + a = ptr + b;is_aligned p pdBits;
            a < 2^ pdBits; b < 2^pdBits \<rbrakk>
       \<Longrightarrow> p = ptr" apply (drule arg_cong[where f = "\<lambda>x. x && ~~ mask pdBits"]) apply (subst (asm) is_aligned_add_helper[THEN conjunct2]) apply simp apply simp apply (subst (asm) is_aligned_add_helper[THEN conjunct2]) apply (simp add:ptr_al) apply simp apply simp done have postfix_listD:
      "\<And>a as. suffix (a # as) [pptrBase >> 20.e.2 ^ (pdBits - 2) - 1]
       \<Longrightarrow> a \<in> set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]" apply (clarsimp simp:suffix_def) apply (subgoal_tac "a \<in> set (zs @ a # as)") apply (drule sym) apply simp apply simp done have in_rangeD: "\<And>x.
       \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk>
       \<Longrightarrow> ptr + (x << 2) \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}" apply (clarsimp simp:blah) apply (intro conjI) apply (rule word_plus_mono_right) apply (simp add: pptrBase_def pdBits_def pageBits_def pdeBits_def) apply (word_bitwise,simp) apply (rule is_aligned_no_wrap'[OF ptr_al]) apply (simp add:pdBits_def pageBits_def pdeBits_def) apply (word_bitwise,simp) apply (rule word_plus_mono_right) apply (simp add:pdBits_def pageBits_def pdeBits_def) apply (word_bitwise,simp) apply (rule is_aligned_no_wrap'[OF ptr_al]) apply (simp add:pdBits_def pageBits_def pdeBits_def) done have offset_bound:
       "\<And>x. \<lbrakk>is_aligned ptr 14;ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF\<rbrakk>
        \<Longrightarrow> x - ptr < 0x4000" apply (clarsimp simp: pptrBase_def field_simps take_bit_Suc) apply unat_arith done show ?thesis apply (case_tac "\<not> is_aligned x 2") apply (rule hoare_name_pre_state) apply (clarsimp) apply (rule_tac Q = "\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2
      \<and> pspace_aligned' s" in hoare_post_imp) apply (frule_tac x = x in not_aligned_eq_None) apply simp apply (frule_tac x = x and s = sa in not_aligned_eq_None) apply simp apply clarsimp apply (drule_tac  x = "armKSGlobalPD (ksArchState sa) + (x && mask pdBits)"
      and  s = sa in not_aligned_eq_None[rotated]) apply (subst is_aligned_mask) apply (simp add: mask_add_aligned mask_twice) apply (simp add:is_aligned_mask pdBits_def mask_def) apply simp apply (wp|simp)+ apply (erule is_aligned_weaken) apply (simp add:pdBits_def) apply (simp add: copyGlobalMappings_def) apply (rule hoare_name_pre_state) apply (rule hoare_conjI) apply (rule hoare_pre) apply (rule hoare_vcg_const_imp_lift) apply wp apply (rule_tac V="\<lambda>xs s. \<forall>x \<in> (set [pptrBase >> 20.e.2 ^ (pdBits - 2) - 1] - set xs).
                                 ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2))"
             and I="\<lambda>s'. globalPD = (armKSGlobalPD (ksArchState s'))
                       \<and> globalPD = (armKSGlobalPD (ksArchState s))"
       in mapM_x_inv_wp2) apply (cut_tac ptr_al) apply (clarsimp simp:blah pdBits_def pageBits_def pdeBits_def) apply (drule_tac x="x - ptr >> 2" in spec) apply (frule offset_bound) apply simp+ apply (erule impE) apply (rule conjI) apply (rule le_shiftr[where u="pptrBase >> 18" and n=2, simplified shiftr_shiftr, simplified]) apply (rule word_le_minus_mono_left[where x=ptr and y="(pptrBase >> 18) + ptr", simplified]) apply (simp add: pptrBase_def add.commute take_bit_Suc) apply (simp add:field_simps) apply (erule is_aligned_no_wrap') apply (simp add: pptrBase_def pdBits_def pageBits_def) apply (drule le_m1_iff_lt[THEN iffD1,THEN iffD2,rotated]) apply simp apply (drule le_shiftr[where u = "x - ptr" and n = 2]) apply simp apply (cut_tac b = 2 and c = 2 and a = "x - ptr" in shiftr_shiftl1) apply simp apply simp apply (cut_tac n = 2 and p = "x - ptr" in is_aligned_neg_mask_eq) apply (erule aligned_sub_aligned) apply (erule is_aligned_weaken,simp) apply simp apply simp apply (drule_tac t = x in
        global_pd_offset[symmetric,unfolded pdBits_def pageBits_def pdeBits_def,simplified]) apply (clarsimp simp:blah field_simps) apply (subgoal_tac "x && mask 14 = x - ptr") apply clarsimp apply (simp add:field_simps) apply (wp hoare_vcg_all_lift getPDE_wp mapM_x_wp'
        | simp add: storePDE_def setObject_def split_def
        updateObject_default_def
        split: option.splits)+ apply (clarsimp simp:objBits_simps archObjSize_def) apply (clarsimp simp:obj_at'_def objBits_simps
        projectKO_def projectKO_opt_pde fail_def return_def
        split: Structures_H.kernel_object.splits
        arch_kernel_object.splits) apply (drule_tac x = xa in bspec) apply simp apply (rule ccontr) apply (simp add: pdeBits_def) apply clarsimp apply (drule(1) ptr_eqD) apply (rule shiftl_less_t2n) apply (simp add:pdBits_def pageBits_def ) apply (rule le_m1_iff_lt[THEN iffD1,THEN iffD1]) apply (simp add: pdeBits_def) apply (simp add: pdeBits_def) apply (simp add:pdBits_def pageBits_def pdeBits_def) apply (simp add: pdeBits_def) apply (rule shiftl_less_t2n) apply (drule postfix_listD) apply (clarsimp simp:pdBits_def pdeBits_def le_less_trans) apply (simp add:pdBits_def pageBits_def pdeBits_def) apply simp apply wp apply (clarsimp simp:objBits_simps archObjSize_def pdeBits_def) apply (rule hoare_name_pre_state) apply (rule hoare_pre) apply (rule hoare_vcg_const_imp_lift) apply wp apply (rule_tac Q = "\<lambda>r s'. ksPSpace s' x = ksPSpace s x \<and> globalPD = armKSGlobalPD (ksArchState s)"
      in hoare_post_imp) apply (wp hoare_vcg_all_lift getPDE_wp mapM_x_wp'
        | simp add: storePDE_def setObject_def split_def
        updateObject_default_def
        split: option.splits)+ apply (clarsimp simp:objBits_simps archObjSize_def pdeBits_def dest!:in_rangeD) apply wp apply simp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (state)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x s. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s\<rbrakk> \<Longrightarrow> ksPSpace s x = None proof (prove)
goal (1 subgoal):
 1. \<And>x s. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s; ksPSpace s x \<noteq> None\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x s y. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s; ksPSpace s x = Some y\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x s y. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s; is_aligned x (objBitsKO y)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x s y. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s\<rbrakk> \<Longrightarrow> 2 \<le> objBitsKO y
 2. \<And>x s y. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s; is_aligned x 2\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x s y x8. \<lbrakk>\<not> is_aligned x 2; pspace_aligned' s; y = KOArch x8\<rbrakk> \<Longrightarrow> 2 \<le> archObjSize x8 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>\<not> is_aligned ?x 2; pspace_aligned' ?s\<rbrakk> \<Longrightarrow> ksPSpace ?s ?x = None

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>p a b. \<lbrakk>p + a = ptr + b; is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (1 subgoal):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p + a && ~~ mask pdBits = ptr + b && ~~ mask pdBits\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (3 subgoals):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> is_aligned p pdBits
 2. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> a < 2 ^ pdBits
 3. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr + b && ~~ mask pdBits\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (2 subgoals):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> a < 2 ^ pdBits
 2. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr + b && ~~ mask pdBits\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (1 subgoal):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr + b && ~~ mask pdBits\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (3 subgoals):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> is_aligned ptr pdBits
 2. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> b < 2 ^ pdBits
 3. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (2 subgoals):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> b < 2 ^ pdBits
 2. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal (1 subgoal):
 1. \<And>p a b. \<lbrakk>is_aligned p pdBits; a < 2 ^ pdBits; b < 2 ^ pdBits; p = ptr\<rbrakk> \<Longrightarrow> p = ptr proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?p + ?a = ptr + ?b; is_aligned ?p pdBits; ?a < 2 ^ pdBits; ?b < 2 ^ pdBits\<rbrakk> \<Longrightarrow> ?p = ptr

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>a as. suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] \<Longrightarrow> a \<in> set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] proof (prove)
goal (1 subgoal):
 1. \<And>a as zs. [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] = zs @ a # as \<Longrightarrow> pptrBase >> 20 \<le> a \<and> a \<le> 2 ^ (pdBits - 2) - 1 proof (prove)
goal (2 subgoals):
 1. \<And>a as zs. \<lbrakk>[pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] = zs @ a # as; a \<in> set (zs @ a # as)\<rbrakk> \<Longrightarrow> pptrBase >> 20 \<le> a \<and> a \<le> 2 ^ (pdBits - 2) - 1
 2. \<And>a as zs. [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] = zs @ a # as \<Longrightarrow> a \<in> set (zs @ a # as) proof (prove)
goal (2 subgoals):
 1. \<And>a as zs. \<lbrakk>a \<in> set (zs @ a # as); zs @ a # as = [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> pptrBase >> 20 \<le> a \<and> a \<le> 2 ^ (pdBits - 2) - 1
 2. \<And>a as zs. [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] = zs @ a # as \<Longrightarrow> a \<in> set (zs @ a # as) proof (prove)
goal (1 subgoal):
 1. \<And>a as zs. [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] = zs @ a # as \<Longrightarrow> a \<in> set (zs @ a # as) proof (prove)
goal:
No subgoals! proof (state)
this:
suffix (?a # ?as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] \<Longrightarrow> ?a \<in> set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (pptrBase >> 20 << 2) \<le> ptr + (x << 2) \<and> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (pptrBase >> 20 << 2) \<le> ptr + (x << 2)
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> pptrBase >> 20 << 2 \<le> x << 2
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (x << 2)
 3. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>0xE00 \<le> x; x \<le> 0xFFF\<rbrakk> \<Longrightarrow> 0x3800 \<le> x << 2
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (x << 2)
 3. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (x << 2)
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> x << 2 < 2 ^ pdBits
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 0xFFF\<rbrakk> \<Longrightarrow> x << 2 < 0x4000
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (x << 2) \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> x << 2 \<le> 2 ^ pdBits - 1
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 0xFFF\<rbrakk> \<Longrightarrow> x << 2 \<le> 0x3FFF
 2. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (2 ^ pdBits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pptrBase >> 20 \<le> x; x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> 2 ^ pdBits - 1 < 2 ^ pdBits proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>pptrBase >> 20 \<le> ?x; ?x \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> ptr + (?x << 2) \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>is_aligned ptr 14; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF\<rbrakk> \<Longrightarrow> x - ptr < 0x4000 proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>is_aligned ptr 14; ptr + 0x3800 \<le> x; x \<le> ptr + 0x3FFF\<rbrakk> \<Longrightarrow> x - ptr < 0x4000 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>is_aligned ptr 14; ptr + (pptrBase >> 20 << 2) \<le> ?x; ?x \<le> ptr + 0x3FFF\<rbrakk> \<Longrightarrow> ?x - ptr < 0x4000

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace>
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<not> is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace>
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ sa. (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)\<rbrace>
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa\<rbrakk> \<Longrightarrow> (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)
 2. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 3. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_aligned' (?s23 s rv sa)
 2. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa; ksPSpace (?s23 s rv sa) x = None\<rbrakk> \<Longrightarrow> (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)
 3. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 4. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa; ksPSpace s x = None\<rbrakk> \<Longrightarrow> (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)
 2. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 3. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa; ksPSpace s x = None\<rbrakk> \<Longrightarrow> pspace_aligned' sa
 2. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa; ksPSpace s x = None; ksPSpace sa x = None\<rbrakk> \<Longrightarrow> (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)
 3. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 4. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s rv sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa)) 2 \<and> pspace_aligned' sa; ksPSpace s x = None; ksPSpace sa x = None\<rbrakk> \<Longrightarrow> (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sa x = ksPSpace s x)
 2. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 3. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; pspace_aligned' sa; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> None = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 2. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 3. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<not> is_aligned (armKSGlobalPD (ksArchState sa) + (x && mask pdBits)) 2
 2. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits)) = None\<rbrakk> \<Longrightarrow> None = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 3. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 4. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> armKSGlobalPD (ksArchState sa) + (x && mask pdBits) && mask 2 \<noteq> 0
 2. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits)) = None\<rbrakk> \<Longrightarrow> None = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 3. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 4. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> x && mask (min 2 pdBits) \<noteq> 0
 2. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits)) = None\<rbrakk> \<Longrightarrow> None = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 3. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 4. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = None; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ksPSpace s x = None; ksPSpace sa x = None; is_aligned (armKSGlobalPD (ksArchState sa)) 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits)) = None\<rbrakk> \<Longrightarrow> None = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 2. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 3. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>r s. is_aligned (armKSGlobalPD (ksArchState s)) 2 \<and> pspace_aligned' s\<rbrace>
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace sa x; pspace_distinct' sa; pspace_aligned' sa; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; s = sa\<rbrakk> \<Longrightarrow> is_aligned (armKSGlobalPD (ksArchState sa)) 2
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>\<not> is_aligned x 2; ko = ksPSpace sa x; pspace_distinct' sa; pspace_aligned' sa; s = sa\<rbrakk> \<Longrightarrow> 2 \<le> pdBits
 2. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<not> \<not> is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. is_aligned x 2 \<Longrightarrow> \<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>_ s. (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>_ s. (x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))) \<and> (x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))\<rbrace>
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))\<rbrace>
 2. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> ?Q59 s sa
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>rv s. ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))\<rbrace>
 2. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s globalPD. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?B65 s globalPD\<rbrace> mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1] \<lbrace>\<lambda>rv s. ksPSpace s x = ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits))\<rbrace>
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>?B65 s\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s globalPD sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s); \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set []. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s globalPD sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s); \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set []. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)); is_aligned ptr pdBits\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask pdBits))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; \<forall>x. pptrBase >> 20 \<le> x \<and> x \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x << 2)); is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ptr + (pptrBase >> 20 << 2) \<le> ?x82 s sa
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ?x82 s sa \<le> ptr + 0x3FFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2)); ?x82 s sa - ptr < 0x4000\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF \<longrightarrow> ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2)); x - ptr < 0x4000\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> pptrBase >> 20 \<le> x - ptr >> 2 \<and> x - ptr >> 2 \<le> 0xFFF
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> pptrBase >> 20 \<le> x - ptr >> 2
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> pptrBase >> 18 \<le> x - ptr
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> (pptrBase >> 18) + ptr \<le> x
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> ptr \<le> (pptrBase >> 18) + ptr
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 4. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 5. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 7. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 8. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> ptr \<le> (pptrBase >> 18) + ptr
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> ptr \<le> ptr + (pptrBase >> 18)
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> pptrBase >> 18 < 2 ^ 14
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14\<rbrakk> \<Longrightarrow> 0 < 0x4000
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr \<le> 0x4000 - 1\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr \<le> 0x4000 - 1\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr >> 2 \<le> 0x4000 - 1 >> 2\<rbrakk> \<Longrightarrow> x - ptr >> 2 \<le> 0xFFF
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2))\<rbrakk> \<Longrightarrow> 2 \<le> 2
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2)); x - ptr >> 2 << 2 = (x - ptr >> 2 - 2) && ~~ mask 2\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr >> 2 << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr >> 2 << 2)); x - ptr >> 2 << 2 = (x - ptr >> 2 - 2) && ~~ mask 2\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2\<rbrakk> \<Longrightarrow> is_aligned (x - ptr) 2
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2\<rbrakk> \<Longrightarrow> 2 < LENGTH(32)
 3. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 4. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2\<rbrakk> \<Longrightarrow> 2 < LENGTH(32)
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa (ptr + (x - ptr && ~~ mask 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr && ~~ mask 2)); x - ptr >> 2 << 2 = x - ptr && ~~ mask 2; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; is_aligned ptr 14; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..0x3FFF + ptr}
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr; x = ptr + (x && mask 14)\<rbrakk> \<Longrightarrow> ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr; x = ptr + (x && mask 14)\<rbrakk> \<Longrightarrow> ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr; x = ptr + (x && mask 14); x && mask 14 = x - ptr\<rbrakk> \<Longrightarrow> ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x && mask 14))
 2. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr; x = ptr + (x && mask 14)\<rbrakk> \<Longrightarrow> x && mask 14 = x - ptr
 3. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ko = ksPSpace s x; ptr + (pptrBase >> 20 << 2) \<le> x; x \<le> ptr + 0x3FFF; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) 14; x - ptr < 0x4000; ksPSpace sa x = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x - ptr)); x - ptr >> 2 << 2 = x - ptr; x - ptr && ~~ mask 2 = x - ptr; x = ptr + (x && mask 14)\<rbrakk> \<Longrightarrow> x && mask 14 = x - ptr
 2. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s globalPD a as. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set (a # as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace> getObject (globalPD + (a << pdeBits)) >>= storePDE (ptr + (a << pdeBits)) \<lbrace>\<lambda>r sa. (globalPD = armKSGlobalPD (ksArchState sa) \<and> globalPD = armKSGlobalPD (ksArchState s)) \<and> (\<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set as. ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (globalPD + (x << 2)))\<rbrace>
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; \<forall>x\<in>{x. pptrBase >> 20 \<le> x \<and> x \<le> 2 ^ (pdBits - 2) - 1} - insert a (set as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x << 2))\<rbrakk> \<Longrightarrow> \<forall>ko. ko_at' ko (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) sa \<longrightarrow> (\<exists>y. fst (lookupAround2 (ptr + (a << pdeBits)) (ksPSpace sa)) = Some y) \<longrightarrow> ptr + (a << pdeBits) = fst (the (fst (lookupAround2 (ptr + (a << pdeBits)) (ksPSpace sa)))) \<longrightarrow> (\<forall>x\<in>{x. pptrBase >> 20 \<le> x \<and> x \<le> 2 ^ (pdBits - 2) - 1} - set as. (x << 2 = a << pdeBits \<longrightarrow> armKSGlobalPD (ksArchState sa) \<noteq> ptr \<longrightarrow> Some (KOArch (KOPDE ko)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits))) \<and> (x << 2 \<noteq> a << pdeBits \<longrightarrow> (armKSGlobalPD (ksArchState sa) + (x << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (x << 2)) = Some (KOArch (KOPDE ko))) \<and> (armKSGlobalPD (ksArchState sa) + (x << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x << 2)))))
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; \<forall>x\<in>{x. pptrBase >> 20 \<le> x \<and> x \<le> 2 ^ (pdBits - 2) - 1} - insert a (set as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x << 2)); ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; ko_at' koa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) sa; ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1\<rbrakk> \<Longrightarrow> (xa << 2 = a << pdeBits \<longrightarrow> armKSGlobalPD (ksArchState sa) \<noteq> ptr \<longrightarrow> Some (KOArch (KOPDE koa)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits))) \<and> (xa << 2 \<noteq> a << pdeBits \<longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2))))
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; \<forall>x\<in>{x. pptrBase >> 20 \<le> x \<and> x \<le> 2 ^ (pdBits - 2) - 1} - insert a (set as). ksPSpace sa (ptr + (x << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (x << 2)); ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits\<rbrakk> \<Longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2)))
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits\<rbrakk> \<Longrightarrow> xa \<in> {x. pptrBase >> 20 \<le> x \<and> x \<le> 2 ^ (pdBits - 2) - 1} - insert a (set as)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2))\<rbrakk> \<Longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2)))
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits\<rbrakk> \<Longrightarrow> xa \<noteq> a
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2))\<rbrakk> \<Longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2)))
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; \<not> xa \<noteq> a\<rbrakk> \<Longrightarrow> False
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2))\<rbrakk> \<Longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2)))
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2))\<rbrakk> \<Longrightarrow> (armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = Some (KOArch (KOPDE koa))) \<and> (armKSGlobalPD (ksArchState sa) + (xa << 2) \<noteq> ptr + (a << pdeBits) \<longrightarrow> ksPSpace sa (ptr + (xa << 2)) = ksPSpace sa (armKSGlobalPD (ksArchState sa) + (xa << 2)))
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) + (xa << 2) = ptr + (a << pdeBits)\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> xa << 2 < 2 ^ pdBits
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> xa < 2 ^ (pdBits - 2)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 4. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (10 + pdeBits) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ (12 + pdeBits) - 1)}; suffix (a # as) [pptrBase >> 20 .e. 0xFFF]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) (12 + pdeBits); is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> xa < 2 ^ (10 + pdeBits)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 4. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (10 + pdeBits) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ (12 + pdeBits) - 1)}; suffix (a # as) [pptrBase >> 20 .e. 0xFFF]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) (12 + pdeBits); is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> 0 < 2 ^ (10 + pdeBits)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (10 + pdeBits) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ (12 + pdeBits) - 1)}; suffix (a # as) [pptrBase >> 20 .e. 0xFFF]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) (12 + pdeBits); is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> xa \<le> 2 ^ (10 + pdeBits) - 1
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 4. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 5. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 7. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 8. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (10 + pdeBits) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ (12 + pdeBits) - 1)}; suffix (a # as) [pptrBase >> 20 .e. 0xFFF]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) (12 + pdeBits); is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> xa \<le> 2 ^ (10 + pdeBits) - 1
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 4. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 6. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 7. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << pdeBits < 2 ^ pdBits
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a << 2 < 2 ^ pdBits
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> a < 2 ^ (pdBits - 2)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b; a \<in> set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> a < 2 ^ (pdBits - 2)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 3. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 5. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 6. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << 2)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << 2)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << 2)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << 2; ksPSpace sa (ptr + (xa << 2)) = Some b\<rbrakk> \<Longrightarrow> pdBits < LENGTH(32)
 2. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 4. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 5. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>s a as sa koa b xa. \<lbrakk>ksPSpace sa (ptr + (a << pdeBits)) = Some b; xa \<notin> set as; pptrBase >> 20 \<le> xa; xa \<le> 2 ^ (pdBits - 2) - 1; armKSGlobalPD (ksArchState s) = armKSGlobalPD (ksArchState sa); is_aligned x 2; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; suffix (a # as) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]; ko = ksPSpace s x; pspace_distinct' s; pspace_aligned' s; is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; is_aligned (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)); ksPSpace sa (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) = Some (KOArch (KOPDE koa)); ps_clear (armKSGlobalPD (ksArchState sa) + (a << pdeBits)) (archObjSize (KOPDE koa)) sa; xa << 2 \<noteq> a << pdeBits; ksPSpace sa (ptr + (xa << 2)) = Some b; armKSGlobalPD (ksArchState sa) = ptr\<rbrakk> \<Longrightarrow> b = KOArch (KOPDE koa)
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 4. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q62 s\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD. (\<lambda>s'. globalPD = armKSGlobalPD (ksArchState s') \<and> globalPD = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s (globalPD + (x << 2)))\<rbrace>
 2. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q62 s sa
 3. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ((\<lambda>s'. (armKSGlobalPD \<circ> ksArchState) sa = armKSGlobalPD (ksArchState s') \<and> (armKSGlobalPD \<circ> ksArchState) sa = armKSGlobalPD (ksArchState s)) and (\<lambda>s. \<forall>x\<in>set [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1] - set [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]. ksPSpace s (ptr + (x << 2)) = ksPSpace s ((armKSGlobalPD \<circ> ksArchState) sa + (x << 2)))) sa
 2. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa\<rbrakk> \<Longrightarrow> \<lbrace>?Q318 s sa\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>r s. x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace s x = ko\<rbrace>
 2. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> ?Q318 s sa sb proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q321 s sa\<rbrace> do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1]
od \<lbrace>\<lambda>rv s. ksPSpace s x = ko\<rbrace>
 2. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q321 s sa sb proof (prove)
goal (3 subgoals):
 1. \<And>s sa globalPD. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?B324 s sa globalPD\<rbrace> mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1] \<lbrace>\<lambda>rv s. ksPSpace s x = ko\<rbrace>
 2. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q321 s sa\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>?B324 s sa\<rbrace>
 3. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q321 s sa sb proof (prove)
goal (4 subgoals):
 1. \<And>s sa globalPD rv sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; ksPSpace sb x = ksPSpace s x \<and> globalPD = armKSGlobalPD (ksArchState s)\<rbrakk> \<Longrightarrow> ksPSpace sb x = ko
 2. \<And>s sa globalPD. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?B324 s sa globalPD\<rbrace> mapM_x (\<lambda>index. getObject (globalPD + (index << pdeBits)) >>= storePDE (ptr + (index << pdeBits))) [pptrBase >> 20 .e. 2 ^ (pdBits - pdeBits) - 1] \<lbrace>\<lambda>r s'. ksPSpace s' x = ksPSpace s x \<and> globalPD = armKSGlobalPD (ksArchState s)\<rbrace>
 3. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q321 s sa\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>?B324 s sa\<rbrace>
 4. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q321 s sa sb proof (prove)
goal (3 subgoals):
 1. \<And>s sa xa sb. \<lbrakk>is_aligned x 2; ksPSpace sa x = ko \<and> pspace_distinct' sa \<and> pspace_aligned' sa \<and> is_aligned (armKSGlobalPD (ksArchState sa)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}; pptrBase >> 20 \<le> xa \<and> xa \<le> 2 ^ (pdBits - pdeBits) - 1; ksPSpace sb x = ko\<rbrakk> \<Longrightarrow> x = ptr + (xa << pdeBits) \<longrightarrow> (\<forall>koa. ko_at' koa (armKSGlobalPD (ksArchState sa) + (xa << pdeBits)) sb \<longrightarrow> (\<exists>y. fst (lookupAround2 (ptr + (xa << pdeBits)) (ksPSpace sb)) = Some y) \<longrightarrow> ptr + (xa << pdeBits) = fst (the (fst (lookupAround2 (ptr + (xa << pdeBits)) (ksPSpace sb)))) \<longrightarrow> Some (KOArch (KOPDE koa)) = ko)
 2. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q321 s sa\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD s'. ksPSpace s' x = ksPSpace s x \<and> globalPD = armKSGlobalPD (ksArchState s)\<rbrace>
 3. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q321 s sa sb proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)}\<rbrakk> \<Longrightarrow> \<lbrace>?Q321 s sa\<rbrace> gets (armKSGlobalPD \<circ> ksArchState) \<lbrace>\<lambda>globalPD s'. ksPSpace s' x = ksPSpace s x \<and> globalPD = armKSGlobalPD (ksArchState s)\<rbrace>
 2. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ?Q321 s sa sb proof (prove)
goal (1 subgoal):
 1. \<And>s sa sb. \<lbrakk>is_aligned x 2; ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits; s = sa; sa = sb\<rbrakk> \<Longrightarrow> x \<notin> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} \<longrightarrow> ksPSpace sb x = ksPSpace s x \<and> (armKSGlobalPD \<circ> ksArchState) sb = armKSGlobalPD (ksArchState s) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>\<lambda>s. ksPSpace s x = ko \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>_ s. ksPSpace s x = (if x \<in> {ptr + (pptrBase >> 20 << 2)..ptr + (2 ^ pdBits - 1)} then ksPSpace s (armKSGlobalPD (ksArchState s) + (x && mask pdBits)) else ko)\<rbrace>

goal:
No subgoals!