theory Detype_R

lemma (in delete_locale) delete_invs':
  "invs' (ksMachineState_update
           (\<lambda>ms. underlying_memory_update
              (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x) ms)
           state')" (is "invs' (?state'')") using vds proof (simp add: invs'_def valid_state'_def valid_pspace'_def
                 valid_mdb'_def valid_mdb_ctes_def,
       safe) interpret Arch .  (*FIXME: arch_split*)
   let ?s = state' let ?ran = base_bits show "pspace_aligned' ?s" using pa by (simp add: pspace_aligned'_def dom_def) show "pspace_distinct' ?s" using pd by (clarsimp simp add: pspace_distinct'_def ps_clear_def
                           dom_if_None Diff_Int_distrib) show "valid_objs' ?s" using valid_objs apply (clarsimp simp: valid_objs'_def ran_def) apply (rule_tac p=a in valid_obj') apply fastforce apply (frule pspace_alignedD'[OF _ pa]) apply (frule pspace_distinctD'[OF _ pd]) apply (clarsimp simp: ko_wp_at'_def) done from sym_refs show "sym_refs (state_refs_of' ?s)" apply - apply (clarsimp simp: state_refs_ko_wp_at_eq
                   elim!: rsubst[where P=sym_refs]) apply (rule ext) apply safe apply (simp add: refs_notRange[simplified] state_refs_ko_wp_at_eq) done from vq show "valid_queues ?s" apply (clarsimp simp: valid_queues_def bitmapQ_defs) apply (clarsimp simp: valid_queues_no_bitmap_def) apply (drule spec, drule spec, drule conjunct1, drule(1) bspec) apply (clarsimp simp: obj_at'_real_def) apply (frule if_live_then_nonz_capE'[OF iflive, OF ko_wp_at'_weakenE]) apply (clarsimp simp: projectKOs inQ_def) apply (clarsimp dest!: ex_nonz_cap_notRange) done from vq' show "valid_queues' ?s" by (simp add: valid_queues'_def) show "if_live_then_nonz_cap' ?s" using iflive apply (clarsimp simp: if_live_then_nonz_cap'_def) apply (drule spec, drule(1) mp) apply (clarsimp simp: ex_nonz_cap_to'_def) apply (rule exI, rule conjI, assumption) apply (drule non_null_present [OF cte_wp_at_weakenE']) apply clarsimp apply simp done from ifunsafe show "if_unsafe_then_cap' ?s" by (clarsimp simp: if_unsafe_then_cap'_def
               intro!: cte_cap) from idle_notRange refs have "ksIdleThread s \<notin> ?ran" apply (simp add: cte_wp_at_ctes_of valid_global_refs'_def valid_refs'_def) apply blast done with idle show "valid_idle' ?s" apply (clarsimp simp: valid_idle'_def pred_tcb_at'_def obj_at'_def projectKOs) apply (clarsimp simp add: ps_clear_def dom_if_None Diff_Int_distrib) done from tcb_at_invs' [OF invs] ct_act show "cur_tcb' ?s" unfolding cur_tcb'_def apply (clarsimp simp: cur_tcb'_def ct_in_state'_def) apply (drule st_tcb) apply simp apply simp apply (simp add: pred_tcb_at'_def) done let ?ctes' = ctes' from no_0 show no_0': "no_0 ?ctes'" by (simp add: no_0_def tree_to_ctes) from dlist show "valid_dlist ?ctes'" apply (simp only: valid_dlist_def3) apply (rule conjI) apply (drule conjunct1) apply (elim allEI) apply (clarsimp simp: mdb_prev_def next_unfold'
                           tree_to_ctes) apply (rule ccontr, clarsimp) apply (cut_tac p="mdbNext (cteMDBNode cte)" in non_null_present) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) not_nullMDBNode) apply (simp add: nullMDBNode_def nullPointer_def no_0) apply simp apply (drule conjunct2) apply (elim allEI) apply (clarsimp simp: mdb_prev_def next_unfold'
                           tree_to_ctes) apply (rule ccontr, clarsimp) apply (cut_tac p="mdbPrev (cteMDBNode z)" in non_null_present) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) not_nullMDBNode) apply (simp add: nullMDBNode_def nullPointer_def no_0) apply simp done from chain_0 show "mdb_chain_0 ?ctes'" by (fastforce simp: mdb_chain_0_def Ball_def) from umdb show "untyped_mdb' ?ctes'" apply (simp add: untyped_mdb'_def) apply (erule allEI)+ apply (clarsimp simp: descendants_of'_def) apply (rule mdb_parent) apply (clarsimp simp: tree_to_ctes split: if_split_asm) done from badges show "valid_badges ?ctes'" by (simp add: valid_badges_def tree_to_ctes next_unfold') from contained show "caps_contained' ?ctes'" by (simp add: caps_contained'_def tree_to_ctes) from chunked show "mdb_chunked ?ctes'" apply (simp add: mdb_chunked_def) apply (elim allEI) apply clarsimp apply (intro conjI impI) apply (erule disjEI) apply fastforce apply fastforce apply (clarsimp dest!: trancl_next_rev) apply (clarsimp dest!: trancl_next_rev) done from uinc show "untyped_inc' ?ctes'" apply (simp add: untyped_inc'_def) apply (elim allEI) apply clarsimp apply (safe del: impCE, simp_all add: descendants_of'_def
                                          mdb_parent) done from nullcaps show "valid_nullcaps ?ctes'" by (clarsimp simp: valid_nullcaps_def) from ut_rev show "ut_revocable' ?ctes'" by (clarsimp simp: ut_revocable'_def) show "class_links ?ctes'" using clinks by (simp add: class_links_def tree_to_ctes mdb_next_unfold) show "valid_global_refs' ?s" using refs by (simp add: valid_global_refs'_def tree_to_ctes valid_cap_sizes'_def
                  global_refs'_def valid_refs'_def ball_ran_eq) show "valid_arch_state' ?s" using arch global_refs2 apply (simp add: valid_arch_state'_def
                     global_refs'_def) apply (intro conjI) apply (simp add: valid_asid_table'_def) apply (simp add: page_directory_at'_def
                      page_directory_refs'_def
                      subset_iff) apply (simp add: valid_global_pts'_def
                     subset_iff
                     page_table_at'_def
                     page_table_refs'_def
                     page_directory_at'_def) by fastforce show "valid_irq_node' (irq_node' s) ?s" using virq irq_nodes_range by (simp add: valid_irq_node'_def mult.commute mult.left_commute ucast_ucast_mask_8
                  cteSizeBits_def shiftl_t2n) show "valid_irq_handlers' ?s" using virqh apply (simp add: valid_irq_handlers'_def irq_issued'_def
                     cteCaps_of_def tree_to_ctes Ball_def) apply (erule allEI) apply (clarsimp simp: ran_def) done from irq_ctrl show "irq_control ?ctes'" by (clarsimp simp: irq_control_def) from dist_z show "distinct_zombies ?ctes'" apply (simp add: tree_to_ctes distinct_zombies_def
                     distinct_zombie_caps_def
                    split del: if_split) apply (erule allEI, erule allEI) apply clarsimp done show "reply_masters_rvk_fb ?ctes'" using rep_r_fb by (simp add: tree_to_ctes reply_masters_rvk_fb_def
                  ball_ran_eq) from virqs show "valid_irq_states' s" . from no_0_objs show "no_0_obj' state'" by (simp add: no_0_obj'_def) from pde_maps show "valid_pde_mappings' state'" by (simp add: valid_pde_mappings'_def) from irqs_masked show "irqs_masked' state'" by (simp add: irqs_masked'_def) from sa_simp ct_act show "sch_act_wf (ksSchedulerAction s) state'" apply (simp add: sch_act_simple_def) apply (case_tac "ksSchedulerAction s", simp_all add: ct_in_state'_def) apply (fastforce dest!: st_tcb elim!: pred_tcb'_weakenE) done from invs have "pspace_domain_valid s" by (simp add: invs'_def valid_state'_def) thus "pspace_domain_valid state'" by (simp add: pspace_domain_valid_def) from invs have "valid_machine_state' s" by (simp add: invs'_def valid_state'_def) thus "valid_machine_state' ?state''" apply (clarsimp simp: valid_machine_state'_def) apply (drule_tac x=p in spec) apply (simp add: pointerInUserData_def pointerInDeviceData_def typ_at'_def) apply (simp add: ko_wp_at'_def exists_disj) apply (elim exE conjE) apply (cut_tac ptr'=p in mask_in_range) apply fastforce using valid_untyped[simplified valid_cap'_def capability.simps] apply (simp add: valid_untyped'_def capAligned_def) apply (elim conjE) apply (drule_tac x="p && ~~ mask pageBits" in spec) apply (cut_tac x=p in is_aligned_neg_mask[OF order_refl]) apply (clarsimp simp: mask_2pm1 ko_wp_at'_def obj_range'_def objBitsKO_def) apply (frule is_aligned_no_overflow'[of base bits]) apply (frule is_aligned_no_overflow'[of _ pageBits]) apply (frule (1) aligned_ranges_subset_or_disjoint
                     [where n=bits and n'=pageBits]) apply (case_tac ko, simp_all add: objBits_simps) apply (auto simp add: x_power_minus_1) done from sa_simp ctnotinQ show "ct_not_inQ state'" apply (clarsimp simp: ct_not_inQ_def pred_tcb_at'_def) apply (drule obj_at'_and
                   [THEN iffD2, OF conjI,
                    OF ct_act [unfolded ct_in_state'_def pred_tcb_at'_def]]) apply (clarsimp simp: obj_at'_real_def) apply (frule if_live_then_nonz_capE'[OF iflive, OF ko_wp_at'_weakenE]) apply (clarsimp simp: projectKOs) apply (case_tac "tcbState obj") apply (clarsimp simp: projectKOs)+ apply (clarsimp dest!: ex_nonz_cap_notRange) done from ctcd show "ct_idle_or_in_cur_domain' state'" apply (simp add: ct_idle_or_in_cur_domain'_def tcb_in_cur_domain'_def) apply (intro impI) apply (elim disjE impE) apply simp+ apply (intro impI) apply (rule disjI2) apply (drule obj_at'_and
                   [THEN iffD2, OF conjI,
                    OF ct_act [unfolded ct_in_state'_def st_tcb_at'_def]]) apply (clarsimp simp: obj_at'_real_def) apply (frule if_live_then_nonz_capE'[OF iflive, OF ko_wp_at'_weakenE]) apply (clarsimp simp: projectKOs) apply (case_tac "tcbState obj") apply (clarsimp simp: projectKOs)+ apply (clarsimp dest!: ex_nonz_cap_notRange elim!: ko_wp_at'_weakenE) done from cdm show "ksCurDomain s \<le> maxDomain" . from invs have urz: "untyped_ranges_zero' s" by (simp add: invs'_def valid_state'_def) show "untyped_ranges_zero_inv (cteCaps_of state')
    (gsUntypedZeroRanges s)" apply (simp add: untyped_zero_ranges_cte_def
                     urz[unfolded untyped_zero_ranges_cte_def, rule_format, symmetric]) apply (clarsimp simp: fun_eq_iff intro!: arg_cong[where f=Ex]) apply safe apply (drule non_null_present[OF cte_wp_at_weakenE']) apply (clarsimp simp: untypedZeroRange_def) apply simp done qed (clarsimp)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. invs' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state') proof (prove)
using this:
valid_dom_schedule' s

goal (1 subgoal):
 1. invs' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state') proof (state)
goal (40 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_aligned' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined)); ksDomSchedule s = ksDomSchedule (newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
A total of 40 subgoals... proof (prove)
goal:
No subgoals! proof (state)
goal (40 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_aligned' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
A total of 40 subgoals... proof (state)
goal (40 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_aligned' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
A total of 40 subgoals... proof (state)
goal (40 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_aligned' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
A total of 40 subgoals... proof (state)
goal (40 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_aligned' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
A total of 40 subgoals... proof (prove)
goal (1 subgoal):
 1. pspace_aligned' state' proof (prove)
using this:
pspace_aligned' s

goal (1 subgoal):
 1. pspace_aligned' state' proof (state)
this:
pspace_aligned' state'

goal (39 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_distinct' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
A total of 39 subgoals... proof (prove)
goal (1 subgoal):
 1. pspace_distinct' state' proof (prove)
using this:
pspace_distinct' s

goal (1 subgoal):
 1. pspace_distinct' state' proof (state)
this:
pspace_distinct' state'

goal (38 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_objs' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
A total of 38 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_objs' state' proof (prove)
using this:
valid_objs' s

goal (1 subgoal):
 1. valid_objs' state' proof (prove)
goal (1 subgoal):
 1. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj\<rbrakk> \<Longrightarrow> valid_obj' obj state' proof (prove)
goal (2 subgoals):
 1. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj\<rbrakk> \<Longrightarrow> valid_obj' obj s
 2. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj\<rbrakk> \<Longrightarrow> ko_wp_at' ((=) obj) a s proof (prove)
goal (1 subgoal):
 1. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj\<rbrakk> \<Longrightarrow> ko_wp_at' ((=) obj) a s proof (prove)
goal (1 subgoal):
 1. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj; is_aligned a (objBitsKO obj)\<rbrakk> \<Longrightarrow> ko_wp_at' ((=) obj) a s proof (prove)
goal (1 subgoal):
 1. \<And>obj a. \<lbrakk>\<forall>obj. (\<exists>a. ksPSpace s a = Some obj) \<longrightarrow> valid_obj' obj s; base \<le> a \<longrightarrow> \<not> a \<le> base + (2 ^ bits - 1); ksPSpace s a = Some obj; is_aligned a (objBitsKO obj); ps_clear a (objBitsKO obj) s\<rbrakk> \<Longrightarrow> ko_wp_at' ((=) obj) a s proof (prove)
goal:
No subgoals! proof (state)
this:
valid_objs' state'

goal (37 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 37 subgoals... proof (chain)
picking this:
sym_refs (state_refs_of' s) proof (prove)
using this:
sym_refs (state_refs_of' s)

goal (1 subgoal):
 1. sym_refs (state_refs_of' state') proof (prove)
goal (1 subgoal):
 1. sym_refs (state_refs_of' s) \<Longrightarrow> sym_refs (state_refs_of' state') proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. {r. ko_wp_at' (\<lambda>ko. r \<in> refs_of' ko) x s}) = (\<lambda>x. {r. ko_wp_at' (\<lambda>ko. r \<in> refs_of' ko) x s \<and> (base \<le> x \<longrightarrow> \<not> x \<le> base + (2 ^ bits - 1))}) proof (prove)
goal (1 subgoal):
 1. \<And>x. {r. ko_wp_at' (\<lambda>ko. r \<in> refs_of' ko) x s} = {r. ko_wp_at' (\<lambda>ko. r \<in> refs_of' ko) x s \<and> (base \<le> x \<longrightarrow> \<not> x \<le> base + (2 ^ bits - 1))} proof (prove)
goal (1 subgoal):
 1. \<And>x a b. \<lbrakk>ko_wp_at' (\<lambda>ko. (a, b) \<in> refs_of' ko) x s; base \<le> x; x \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
sym_refs (state_refs_of' state')

goal (36 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 36 subgoals... proof (chain)
picking this:
Invariants_H.valid_queues s proof (prove)
using this:
Invariants_H.valid_queues s

goal (1 subgoal):
 1. Invariants_H.valid_queues state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_queues_no_bitmap s; \<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize\<rbrakk> \<Longrightarrow> valid_queues_no_bitmap state' proof (prove)
goal (1 subgoal):
 1. \<And>d p t. \<lbrakk>\<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p and runnable' \<circ> tcbState) t s) \<and> distinct (ksReadyQueues s (d, p)) \<and> (maxDomain < d \<longrightarrow> ksReadyQueues s (d, p) = []) \<and> (maxPriority < p \<longrightarrow> ksReadyQueues s (d, p) = []); \<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>d p t. \<lbrakk>\<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1); obj_at' (inQ d p and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>d p t. \<lbrakk>\<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> inQ d p obj \<and> runnable' (tcbState obj)) t s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>d p t ko. \<lbrakk>\<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> inQ d p obj \<and> runnable' (tcbState obj)) t s; \<exists>obj. projectKO_opt ko = Some obj \<and> inQ d p obj \<and> runnable' (tcbState obj)\<rbrakk> \<Longrightarrow> live' ko
 2. \<And>d p t. \<lbrakk>\<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> inQ d p obj \<and> runnable' (tcbState obj)) t s; ex_nonz_cap_to' t s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>d p t. \<lbrakk>\<forall>d p. (ksReadyQueuesL1Bitmap s d !! prioToL1Index p \<and> ksReadyQueuesL2Bitmap s (d, invertL1Index (prioToL1Index p)) !! unat (p && mask wordRadix)) = (ksReadyQueues s (d, p) \<noteq> []); \<forall>d i. Ex ((!!) (ksReadyQueuesL2Bitmap s (d, invertL1Index i))) \<and> i < l2BitmapSize \<longrightarrow> ksReadyQueuesL1Bitmap s d !! i; \<forall>d i. ksReadyQueuesL1Bitmap s d !! i \<longrightarrow> ksReadyQueuesL2Bitmap s (d, invertL1Index i) \<noteq> 0 \<and> i < l2BitmapSize; t \<in> set (ksReadyQueues s (d, p)); base \<le> t; t \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> inQ d p obj \<and> runnable' (tcbState obj)) t s; ex_nonz_cap_to' t s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
Invariants_H.valid_queues state'

goal (35 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 35 subgoals... proof (chain)
picking this:
valid_queues' s proof (prove)
using this:
valid_queues' s

goal (1 subgoal):
 1. valid_queues' state' proof (state)
this:
valid_queues' state'

goal (34 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 34 subgoals... proof (prove)
goal (1 subgoal):
 1. if_live_then_nonz_cap' state' proof (prove)
using this:
if_live_then_nonz_cap' s

goal (1 subgoal):
 1. if_live_then_nonz_cap' state' proof (prove)
goal (1 subgoal):
 1. \<And>ptr. \<lbrakk>\<forall>ptr. ko_wp_at' live' ptr s \<longrightarrow> ex_nonz_cap_to' ptr s; ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr state' proof (prove)
goal (1 subgoal):
 1. \<And>ptr. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); ex_nonz_cap_to' ptr s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr state' proof (prove)
goal (1 subgoal):
 1. \<And>ptr cref. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); cte_wp_at' (\<lambda>c. ptr \<in> zobj_refs' (cteCap c)) cref s\<rbrakk> \<Longrightarrow> \<exists>cref. cte_wp_at' (\<lambda>c. ptr \<in> zobj_refs' (cteCap c)) cref s \<and> (base \<le> cref \<longrightarrow> \<not> cref \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>ptr cref. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); cte_wp_at' (\<lambda>c. ptr \<in> zobj_refs' (cteCap c)) cref s\<rbrakk> \<Longrightarrow> base \<le> cref \<longrightarrow> \<not> cref \<le> base + (2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>ptr cref c. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); ptr \<in> zobj_refs' (cteCap c)\<rbrakk> \<Longrightarrow> cteCap c \<noteq> capability.NullCap
 2. \<And>ptr cref. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); cref \<notin> base_bits\<rbrakk> \<Longrightarrow> base \<le> cref \<longrightarrow> \<not> cref \<le> base + (2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>ptr cref. \<lbrakk>ko_wp_at' live' ptr s; base \<le> ptr \<longrightarrow> \<not> ptr \<le> base + (2 ^ bits - 1); cref \<notin> base_bits\<rbrakk> \<Longrightarrow> base \<le> cref \<longrightarrow> \<not> cref \<le> base + (2 ^ bits - 1) proof (prove)
goal:
No subgoals! proof (state)
this:
if_live_then_nonz_cap' state'

goal (33 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 33 subgoals... proof (chain)
picking this:
if_unsafe_then_cap' s proof (prove)
using this:
if_unsafe_then_cap' s

goal (1 subgoal):
 1. if_unsafe_then_cap' state' proof (state)
this:
if_unsafe_then_cap' state'

goal (32 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 32 subgoals... proof (chain)
picking this:
\<forall>cref. \<not> cte_wp_at' (\<lambda>c. ksIdleThread s \<in> capRange (cteCap c)) cref s \<Longrightarrow> ksIdleThread s \<notin> base_bits
valid_global_refs' s proof (prove)
using this:
\<forall>cref. \<not> cte_wp_at' (\<lambda>c. ksIdleThread s \<in> capRange (cteCap c)) cref s \<Longrightarrow> ksIdleThread s \<notin> base_bits
valid_global_refs' s

goal (1 subgoal):
 1. ksIdleThread s \<notin> base_bits proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>cref cte. ctes_of s cref = Some cte \<longrightarrow> ksIdleThread s \<notin> capRange (cteCap cte) \<Longrightarrow> base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1); (\<forall>c\<in>ran (ctes_of s). kernel_data_refs \<inter> capRange (cteCap c) = {}) \<and> global_refs' s \<subseteq> kernel_data_refs \<and> valid_cap_sizes' (gsMaxObjectSize s) (ctes_of s)\<rbrakk> \<Longrightarrow> base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1) proof (prove)
goal:
No subgoals! proof (state)
this:
ksIdleThread s \<notin> base_bits

goal (32 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 32 subgoals... proof (chain)
picking this:
valid_idle' s
ksIdleThread s \<notin> base_bits proof (prove)
using this:
valid_idle' s
ksIdleThread s \<notin> base_bits

goal (1 subgoal):
 1. valid_idle' state' proof (prove)
goal (1 subgoal):
 1. \<And>obj. \<lbrakk>base \<le> idle_thread_ptr \<longrightarrow> \<not> idle_thread_ptr \<le> base + (2 ^ bits - 1); idle_thread_ptr = ksIdleThread s; ksPSpace s idle_thread_ptr = Some (KOTCB obj); is_aligned idle_thread_ptr (objBitsKO (KOTCB obj)); idle_tcb' obj; ps_clear idle_thread_ptr (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> ps_clear idle_thread_ptr (objBitsKO (KOTCB obj)) state' proof (prove)
goal:
No subgoals! proof (state)
this:
valid_idle' state'

goal (31 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 31 subgoals... proof (chain)
picking this:
tcb_at' (ksCurThread s) s
ct_active' s proof (prove)
using this:
tcb_at' (ksCurThread s) s
ct_active' s

goal (1 subgoal):
 1. cur_tcb' state' proof (prove)
using this:
tcb_at' (ksCurThread s) s
ct_active' s

goal (1 subgoal):
 1. tcb_at' (ksCurThread state') state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>tcb_at' (ksCurThread s) s; st_tcb_at' active' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> \<not> active' Structures_H.thread_state.Inactive
 2. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> \<not> active' Structures_H.thread_state.IdleThreadState
 3. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); st_tcb_at' active' (ksCurThread s) state'\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> \<not> active' Structures_H.thread_state.IdleThreadState
 2. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); st_tcb_at' active' (ksCurThread s) state'\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>tcb_at' (ksCurThread s) s; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); st_tcb_at' active' (ksCurThread s) state'\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
cur_tcb' state'

goal (30 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 30 subgoals... proof (state)
goal (30 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
A total of 30 subgoals... proof (chain)
picking this:
no_0 (ctes_of s) proof (prove)
using this:
no_0 (ctes_of s)

goal (1 subgoal):
 1. no_0 ctes' proof (state)
this:
no_0 ctes'

goal (29 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_dlist ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
A total of 29 subgoals... proof (chain)
picking this:
valid_dlist (ctes_of s) proof (prove)
using this:
valid_dlist (ctes_of s)

goal (1 subgoal):
 1. valid_dlist ctes' proof (prove)
goal (1 subgoal):
 1. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> (\<forall>c c'. ctes' \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c') proof (prove)
goal (2 subgoals):
 1. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leftarrow> c'
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (2 subgoals):
 1. \<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c' \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leftarrow> c'
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (2 subgoals):
 1. \<And>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c' \<Longrightarrow> ctes' \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leftarrow> c'
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (2 subgoals):
 1. \<And>c cte. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>z. ctes_of s (mdbNext (cteMDBNode cte)) = Some z \<and> c = mdbPrev (cteMDBNode z)); base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> c \<longrightarrow> \<not> c \<le> base + (2 ^ bits - 1); ctes_of s c = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) = 0
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (2 subgoals):
 1. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z\<rbrakk> \<Longrightarrow> False
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (3 subgoals):
 1. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (mdbNext (cteMDBNode cte)) s
 2. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbNext (cteMDBNode cte) \<notin> base_bits\<rbrakk> \<Longrightarrow> False
 3. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (3 subgoals):
 1. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z; cteCap z = capability.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbNext (cteMDBNode cte) \<notin> base_bits\<rbrakk> \<Longrightarrow> False
 3. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (3 subgoals):
 1. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; cteCap z = capability.NullCap; cteMDBNode z = nullMDBNode\<rbrakk> \<Longrightarrow> False
 2. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbNext (cteMDBNode cte) \<notin> base_bits\<rbrakk> \<Longrightarrow> False
 3. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (2 subgoals):
 1. \<And>cte z. \<lbrakk>base \<le> mdbNext (cteMDBNode cte); mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); base \<le> mdbPrev (cteMDBNode z) \<longrightarrow> \<not> mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbNext (cteMDBNode cte) \<notin> base_bits\<rbrakk> \<Longrightarrow> False
 2. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (1 subgoal):
 1. (\<forall>c c'. ctes_of s \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c') \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (1 subgoal):
 1. \<forall>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c' \<Longrightarrow> \<forall>c c'. ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (1 subgoal):
 1. \<And>c c'. ctes_of s \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes_of s \<turnstile> c \<leadsto> c' \<Longrightarrow> ctes' \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> ctes' \<turnstile> c \<leadsto> c' proof (prove)
goal (1 subgoal):
 1. \<And>c' z. \<lbrakk>mdbPrev (cteMDBNode z) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode z)) = Some cte \<and> mdbNext (cteMDBNode cte) = c'); base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> c' \<longrightarrow> \<not> c' \<le> base + (2 ^ bits - 1); ctes_of s c' = Some z\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode z) = 0 proof (prove)
goal (1 subgoal):
 1. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c \<noteq> capability.NullCap) (mdbPrev (cteMDBNode z)) s
 2. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbPrev (cteMDBNode z) \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbPrev (cteMDBNode z) \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; cteCap cte = capability.NullCap; cteMDBNode cte = nullMDBNode\<rbrakk> \<Longrightarrow> False
 2. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbPrev (cteMDBNode z) \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z cte. \<lbrakk>base \<le> mdbPrev (cteMDBNode z); mdbPrev (cteMDBNode z) \<le> base + (2 ^ bits - 1); base \<le> mdbNext (cteMDBNode cte) \<longrightarrow> \<not> mdbNext (cteMDBNode cte) \<le> base + (2 ^ bits - 1); ctes_of s (mdbNext (cteMDBNode cte)) = Some z; mdbPrev (cteMDBNode z) \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode z)) = Some cte; mdbPrev (cteMDBNode z) \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
valid_dlist ctes'

goal (28 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chain_0 ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
A total of 28 subgoals... proof (chain)
picking this:
mdb_chain_0 (ctes_of s) proof (prove)
using this:
mdb_chain_0 (ctes_of s)

goal (1 subgoal):
 1. mdb_chain_0 ctes' proof (state)
this:
mdb_chain_0 ctes'

goal (27 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_mdb' ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
A total of 27 subgoals... proof (chain)
picking this:
untyped_mdb' (ctes_of s) proof (prove)
using this:
untyped_mdb' (ctes_of s)

goal (1 subgoal):
 1. untyped_mdb' ctes' proof (prove)
goal (1 subgoal):
 1. \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)) \<Longrightarrow> \<forall>p p' c. (\<exists>n. ctes' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes' p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p ctes') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)) \<Longrightarrow> (\<exists>n. ctes' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes' p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p ctes') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>ctes_of s \<turnstile> p \<rightarrow> p'; ctes_of s p = Some (CTE c n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); isUntypedCap c; ctes_of s p' = Some (CTE c' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> ctes' \<turnstile> p \<rightarrow> p' proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>ctes_of s \<turnstile> p \<rightarrow> p'; ctes_of s p = Some (CTE c n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); isUntypedCap c; ctes_of s p' = Some (CTE c' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<rightarrow> p' proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_mdb' ctes'

goal (26 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_badges ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
A total of 26 subgoals... proof (chain)
picking this:
valid_badges (ctes_of s) proof (prove)
using this:
valid_badges (ctes_of s)

goal (1 subgoal):
 1. valid_badges ctes' proof (state)
this:
valid_badges ctes'

goal (25 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> caps_contained' ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
A total of 25 subgoals... proof (chain)
picking this:
caps_contained' (ctes_of s) proof (prove)
using this:
caps_contained' (ctes_of s)

goal (1 subgoal):
 1. caps_contained' ctes' proof (state)
this:
caps_contained' ctes'

goal (24 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> mdb_chunked ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
A total of 24 subgoals... proof (chain)
picking this:
mdb_chunked (ctes_of s) proof (prove)
using this:
mdb_chunked (ctes_of s)

goal (1 subgoal):
 1. mdb_chunked ctes' proof (prove)
goal (1 subgoal):
 1. \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)) \<Longrightarrow> \<forall>p p' cap. (\<exists>n. ctes' p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes' p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ctes' cap p p') \<and> (ctes' \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ctes' cap' p' p)) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)) \<Longrightarrow> (\<exists>n. ctes' p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes' p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ctes' cap p p') \<and> (ctes' \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ctes' cap' p' p)) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p\<rbrakk> \<Longrightarrow> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ctes' cap p p') \<and> (ctes' \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ctes' cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p\<rbrakk> \<Longrightarrow> ctes' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p
 2. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk ctes' cap p p'
 3. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk ctes' cap' p' p proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> ctes' \<turnstile> p \<leadsto>\<^sup>+ p'
 2. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p
 3. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk ctes' cap p p'
 4. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk ctes' cap' p' p proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> ctes' \<turnstile> p' \<leadsto>\<^sup>+ p
 2. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk ctes' cap p p'
 3. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk ctes' cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk ctes' cap p p'
 2. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk ctes' cap' p' p proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'. \<lbrakk>ctes_of s p = Some (CTE cap n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ctes_of s p' = Some (CTE cap' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); global.sameRegionAs cap cap'; p \<noteq> p'; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p; ctes' \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk ctes' cap' p' p proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chunked ctes'

goal (23 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_inc' ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_global_refs' state'
A total of 23 subgoals... proof (chain)
picking this:
untyped_inc' (ctes_of s) proof (prove)
using this:
untyped_inc' (ctes_of s)

goal (1 subgoal):
 1. untyped_inc' ctes' proof (prove)
goal (1 subgoal):
 1. \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')) \<Longrightarrow> \<forall>p p' c. (\<exists>n. ctes' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes' p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ctes' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p ctes' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ctes' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' ctes' \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')) \<Longrightarrow> (\<exists>n. ctes' p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes' p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ctes' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p ctes' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ctes' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' ctes' \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n'. \<lbrakk>ctes_of s p = Some (CTE c n); base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); isUntypedCap c; ctes_of s p' = Some (CTE c' n'); base \<le> p' \<longrightarrow> \<not> p' \<le> base + (2 ^ bits - 1); isUntypedCap c'; untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p'\<rbrakk> \<Longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ctes') \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p ctes') \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ctes' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' ctes' \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_inc' ctes'

goal (22 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_nullcaps ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_global_refs' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_arch_state' state'
A total of 22 subgoals... proof (chain)
picking this:
valid_nullcaps (ctes_of s) proof (prove)
using this:
valid_nullcaps (ctes_of s)

goal (1 subgoal):
 1. valid_nullcaps ctes' proof (state)
this:
valid_nullcaps ctes'

goal (21 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ut_revocable' ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_global_refs' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_arch_state' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_node' (irq_node' s) state'
A total of 21 subgoals... proof (chain)
picking this:
ut_revocable' (ctes_of s) proof (prove)
using this:
ut_revocable' (ctes_of s)

goal (1 subgoal):
 1. ut_revocable' ctes' proof (state)
this:
ut_revocable' ctes'

goal (20 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> class_links ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_global_refs' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_arch_state' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_node' (irq_node' s) state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_handlers' state'
A total of 20 subgoals... proof (prove)
goal (1 subgoal):
 1. class_links ctes' proof (prove)
using this:
class_links (ctes_of s)

goal (1 subgoal):
 1. class_links ctes' proof (state)
this:
class_links ctes'

goal (19 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_global_refs' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_arch_state' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_node' (irq_node' s) state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_handlers' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
A total of 19 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_global_refs' state' proof (prove)
using this:
valid_global_refs' s

goal (1 subgoal):
 1. valid_global_refs' state' proof (state)
this:
valid_global_refs' state'

goal (18 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_arch_state' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_node' (irq_node' s) state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_handlers' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
A total of 18 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_arch_state' state' proof (prove)
using this:
valid_arch_state' s
global_refs' s \<subseteq> - base_bits

goal (1 subgoal):
 1. valid_arch_state' state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> valid_asid_table' (armKSASIDTable (ksArchState s)) state' \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) state' \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) state' proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> valid_asid_table' (armKSASIDTable (ksArchState s)) state'
 2. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s)) state'
 3. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s)) state' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s)) state'
 2. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s)) state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s)) s \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<subseteq> - base_bits \<and> \<Union> (page_table_refs' ` set (armKSGlobalPTs (ksArchState s))) \<subseteq> - base_bits \<and> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<subseteq> - base_bits\<rbrakk> \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s)) state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_asid_table' (armKSASIDTable (ksArchState s)) s \<and> is_aligned (armKSGlobalPD (ksArchState s)) pdBits \<and> (\<forall>y<0x1000. pde_at' (armKSGlobalPD (ksArchState s) + (y << 2)) s) \<and> (\<forall>p\<in>set (armKSGlobalPTs (ksArchState s)). is_aligned p ptBits \<and> (\<forall>y<0x100. pte_at' (p + (y << 2)) s)) \<and> is_inv (armKSHWASIDTable (ksArchState s)) (map_option fst \<circ> armKSASIDMap (ksArchState s)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s)); (base \<le> ksIdleThread s \<longrightarrow> \<not> ksIdleThread s \<le> base + (2 ^ bits - 1)) \<and> (\<forall>t. t \<in> page_directory_refs' (armKSGlobalPD (ksArchState s)) \<longrightarrow> base \<le> t \<longrightarrow> \<not> t \<le> base + (2 ^ bits - 1)) \<and> (\<forall>t. (\<exists>x\<in>set (armKSGlobalPTs (ksArchState s)). t \<in> (\<lambda>xa. x + (xa << 2)) ` {y. y < 0x100}) \<longrightarrow> base \<le> t \<longrightarrow> \<not> t \<le> base + (2 ^ bits - 1)) \<and> (\<forall>t. t \<in> range (\<lambda>irq. irq_node' s + (UCAST(10 \<rightarrow> 32) irq << cteSizeBits)) \<longrightarrow> base \<le> t \<longrightarrow> \<not> t \<le> base + (2 ^ bits - 1))\<rbrakk> \<Longrightarrow> \<forall>p\<in>set (armKSGlobalPTs (ksArchState s)). \<forall>y<0x100. base \<le> p + (y << 2) \<longrightarrow> \<not> p + (y << 2) \<le> base + (2 ^ bits - 1) proof (state)
this:
valid_arch_state' state'

goal (17 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_node' (irq_node' s) state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_handlers' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
A total of 17 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_irq_node' (irq_node' s) state' proof (prove)
using this:
valid_irq_node' (irq_node' s) s
\<forall>irq. irq_node' s + UCAST(10 \<rightarrow> 32) irq * 0x10 \<notin> base_bits

goal (1 subgoal):
 1. valid_irq_node' (irq_node' s) state' proof (state)
this:
valid_irq_node' (irq_node' s) state'

goal (16 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_handlers' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
A total of 16 subgoals... proof (prove)
goal (1 subgoal):
 1. valid_irq_handlers' state' proof (prove)
using this:
valid_irq_handlers' s

goal (1 subgoal):
 1. valid_irq_handlers' state' proof (prove)
goal (1 subgoal):
 1. \<forall>x. x \<in> ran (map_option cteCap \<circ> ctes_of s) \<longrightarrow> (\<forall>irq. x = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<Longrightarrow> \<forall>x. x \<in> ran (map_option cteCap \<circ> (\<lambda>x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then None else ctes_of s x)) \<longrightarrow> (\<forall>irq. x = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> ran (map_option cteCap \<circ> ctes_of s) \<longrightarrow> (\<forall>irq. x = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<Longrightarrow> x \<in> ran (map_option cteCap \<circ> (\<lambda>x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then None else ctes_of s x)) \<longrightarrow> (\<forall>irq. x = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) proof (prove)
goal:
No subgoals! proof (state)
this:
valid_irq_handlers' state'

goal (15 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irq_control ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
A total of 15 subgoals... proof (chain)
picking this:
irq_control (ctes_of s) proof (prove)
using this:
irq_control (ctes_of s)

goal (1 subgoal):
 1. irq_control ctes' proof (state)
this:
irq_control ctes'

goal (14 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> distinct_zombies ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_pde_mappings' state'
A total of 14 subgoals... proof (chain)
picking this:
distinct_zombies (ctes_of s) proof (prove)
using this:
distinct_zombies (ctes_of s)

goal (1 subgoal):
 1. distinct_zombies ctes' proof (prove)
goal (1 subgoal):
 1. \<forall>ptr ptr' cap cap'. (\<exists>z. ctes_of s ptr = Some z \<and> cteCap z = cap) \<and> (\<exists>z. ctes_of s ptr' = Some z \<and> cteCap z = cap') \<and> ptr \<noteq> ptr' \<and> isZombie cap \<and> capClass cap' = PhysicalClass \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> capBits cap = capBits cap' \<longrightarrow> global.capUntypedPtr cap \<noteq> global.capUntypedPtr cap' \<Longrightarrow> \<forall>ptr ptr' cap cap'. (\<exists>z. (if base \<le> ptr \<and> ptr \<le> base + (2 ^ bits - 1) then None else ctes_of s ptr) = Some z \<and> cteCap z = cap) \<and> (\<exists>z. (if base \<le> ptr' \<and> ptr' \<le> base + (2 ^ bits - 1) then None else ctes_of s ptr') = Some z \<and> cteCap z = cap') \<and> ptr \<noteq> ptr' \<and> isZombie cap \<and> capClass cap' = PhysicalClass \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> capBits cap = capBits cap' \<longrightarrow> global.capUntypedPtr cap \<noteq> global.capUntypedPtr cap' proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr'. \<forall>cap cap'. (\<exists>z. ctes_of s ptr = Some z \<and> cteCap z = cap) \<and> (\<exists>z. ctes_of s ptr' = Some z \<and> cteCap z = cap') \<and> ptr \<noteq> ptr' \<and> isZombie cap \<and> capClass cap' = PhysicalClass \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> capBits cap = capBits cap' \<longrightarrow> global.capUntypedPtr cap \<noteq> global.capUntypedPtr cap' \<Longrightarrow> \<forall>cap cap'. (\<exists>z. (if base \<le> ptr \<and> ptr \<le> base + (2 ^ bits - 1) then None else ctes_of s ptr) = Some z \<and> cteCap z = cap) \<and> (\<exists>z. (if base \<le> ptr' \<and> ptr' \<le> base + (2 ^ bits - 1) then None else ctes_of s ptr') = Some z \<and> cteCap z = cap') \<and> ptr \<noteq> ptr' \<and> isZombie cap \<and> capClass cap' = PhysicalClass \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> capBits cap = capBits cap' \<longrightarrow> global.capUntypedPtr cap \<noteq> global.capUntypedPtr cap' proof (prove)
goal:
No subgoals! proof (state)
this:
distinct_zombies ctes'

goal (13 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ctes'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_pde_mappings' state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. reply_masters_rvk_fb ctes' proof (prove)
using this:
reply_masters_rvk_fb (ctes_of s)

goal (1 subgoal):
 1. reply_masters_rvk_fb ctes' proof (state)
this:
reply_masters_rvk_fb ctes'

goal (12 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_irq_states' s
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_pde_mappings' state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
A total of 12 subgoals... proof (chain)
picking this:
valid_irq_states' s proof (prove)
using this:
valid_irq_states' s

goal (1 subgoal):
 1. valid_irq_states' s proof (state)
this:
valid_irq_states' s

goal (11 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> no_0_obj' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_pde_mappings' state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
A total of 11 subgoals... proof (chain)
picking this:
no_0_obj' s proof (prove)
using this:
no_0_obj' s

goal (1 subgoal):
 1. no_0_obj' state' proof (state)
this:
no_0_obj' state'

goal (10 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_pde_mappings' state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 10. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
valid_pde_mappings' s proof (prove)
using this:
valid_pde_mappings' s

goal (1 subgoal):
 1. valid_pde_mappings' state' proof (state)
this:
valid_pde_mappings' state'

goal (9 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> irqs_masked' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 9. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
irqs_masked' s proof (prove)
using this:
irqs_masked' s

goal (1 subgoal):
 1. irqs_masked' state' proof (state)
this:
irqs_masked' state'

goal (8 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 8. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
sch_act_simple s
ct_active' s proof (prove)
using this:
sch_act_simple s
ct_active' s

goal (1 subgoal):
 1. sch_act_wf (ksSchedulerAction s) state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; ct_active' s\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>st_tcb_at' active' (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> st_tcb_at' activatable' (ksCurThread s) state' proof (prove)
goal:
No subgoals! proof (state)
this:
sch_act_wf (ksSchedulerAction s) state'

goal (7 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
invs' s proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. pspace_domain_valid s proof (state)
this:
pspace_domain_valid s

goal (7 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> pspace_domain_valid state'
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 7. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (prove)
using this:
pspace_domain_valid s

goal (1 subgoal):
 1. pspace_domain_valid state' proof (state)
this:
pspace_domain_valid state'

goal (6 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
invs' s proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. valid_machine_state' s proof (state)
this:
valid_machine_state' s

goal (6 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 6. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (prove)
using this:
valid_machine_state' s

goal (1 subgoal):
 1. valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state') proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>\<forall>p. pointerInUserData p s \<or> pointerInDeviceData p s \<or> underlying_memory (ksMachineState s) p = 0; base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); \<not> pointerInUserData p state'; underlying_memory (ksMachineState s) p \<noteq> 0\<rbrakk> \<Longrightarrow> pointerInDeviceData p state' proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); \<not> pointerInUserData p state'; underlying_memory (ksMachineState s) p \<noteq> 0; pointerInUserData p s \<or> pointerInDeviceData p s \<or> underlying_memory (ksMachineState s) p = 0\<rbrakk> \<Longrightarrow> pointerInDeviceData p state' proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. koTypeOf ko = UserDataT) (p && ~~ mask pageBits) s \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ko_wp_at' (\<lambda>ko. koTypeOf ko = UserDataT) (p && ~~ mask pageBits) s \<or> ko_wp_at' (\<lambda>ko. koTypeOf ko = UserDataDeviceT) (p && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> ko_wp_at' (\<lambda>ko. koTypeOf ko = UserDataDeviceT) (p && ~~ mask pageBits) s \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; \<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> (is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s)\<rbrakk> \<Longrightarrow> (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s\<rbrakk> \<Longrightarrow> (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (2 subgoals):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s\<rbrakk> \<Longrightarrow> is_aligned (?ptr17 p ko) (?bits17 p ko)
 2. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (?bits17 p ko) = ?ptr17 p ko) = (p \<in> {?ptr17 p ko..?ptr17 p ko + 2 ^ ?bits17 p ko - 1})\<rbrakk> \<Longrightarrow> (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p \<in> {p && ~~ mask pageBits..(p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1})\<rbrakk> \<Longrightarrow> (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
using this:
capAligned (capability.UntypedCap d base bits idx) \<and> valid_untyped' d base bits idx s \<and> base \<noteq> 0 \<and> minUntypedSizeBits \<le> bits \<and> bits \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ bits \<and> is_aligned (word_of_nat idx) minUntypedSizeBits

goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p \<in> {p && ~~ mask pageBits..(p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1})\<rbrakk> \<Longrightarrow> (\<exists>ko. ksPSpace s (p && ~~ mask pageBits) = Some ko \<and> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s) \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p && ~~ mask pageBits \<le> p \<and> p \<le> (p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1); is_aligned base bits \<and> bits < word_bits \<and> (\<forall>ptr'. \<not> ko_wp_at' (\<lambda>ko. {base..base + 2 ^ bits - 1} \<subset> obj_range' ptr' ko \<or> obj_range' ptr' ko \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) \<noteq> {}) ptr' s) \<and> base \<noteq> 0 \<and> minUntypedSizeBits \<le> bits \<and> bits \<le> maxUntypedSizeBits \<and> idx \<le> 2 ^ bits \<and> is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p && ~~ mask pageBits \<le> p \<and> p \<le> (p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1); is_aligned base bits; bits < word_bits; \<forall>ptr'. \<not> ko_wp_at' (\<lambda>ko. {base..base + 2 ^ bits - 1} \<subset> obj_range' ptr' ko \<or> obj_range' ptr' ko \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) \<noteq> {}) ptr' s; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p && ~~ mask pageBits \<le> p \<and> p \<le> (p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> ko_wp_at' (\<lambda>ko. {base..base + 2 ^ bits - 1} \<subset> obj_range' (p && ~~ mask pageBits) ko \<or> obj_range' (p && ~~ mask pageBits) ko \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) \<noteq> {}) (p && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<longrightarrow> base \<le> p && ~~ mask pageBits \<and> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ mask pageBits) = Some ko; is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<or> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s; (p && ~~ mask (objBitsKO ko) = p && ~~ mask pageBits) = (p && ~~ mask pageBits \<le> p \<and> p \<le> (p && ~~ mask pageBits) + 2 ^ objBitsKO ko - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> ko_wp_at' (\<lambda>ko. {base..base + 2 ^ bits - 1} \<subset> obj_range' (p && ~~ mask pageBits) ko \<or> obj_range' (p && ~~ mask pageBits) ko \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) \<noteq> {}) (p && ~~ mask pageBits) s; is_aligned (p && ~~ mask (?m46 p ko)) (?m46 p ko)\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask pageBits) (objBitsKO ko) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ mask pageBits) (objBitsKO ko) s \<and> (base \<le> p && ~~ mask pageBits \<longrightarrow> \<not> p && ~~ mask pageBits \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<longrightarrow> base \<le> p && ~~ (2 ^ pageBits - 1) \<and> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some ko; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<or> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s; (p && ~~ (2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1) = p && ~~ (2 ^ pageBits - 1)) = (p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<longrightarrow> \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {} \<or> \<not> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; is_aligned (p && ~~ (2 ^ ?m46 p ko - 1)) (?m46 p ko)\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<and> (base \<le> p && ~~ (2 ^ pageBits - 1) \<longrightarrow> \<not> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<longrightarrow> base \<le> p && ~~ (2 ^ pageBits - 1) \<and> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some ko; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<or> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s; (p && ~~ (2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1) = p && ~~ (2 ^ pageBits - 1)) = (p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<longrightarrow> \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {} \<or> \<not> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; is_aligned (p && ~~ (2 ^ ?m46 p ko - 1)) (?m46 p ko); base \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<and> (base \<le> p && ~~ (2 ^ pageBits - 1) \<longrightarrow> \<not> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<longrightarrow> base \<le> p && ~~ (2 ^ pageBits - 1) \<and> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some ko; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<or> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s; (p && ~~ (2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1) = p && ~~ (2 ^ pageBits - 1)) = (p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<longrightarrow> \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {} \<or> \<not> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; is_aligned (p && ~~ (2 ^ pageBits - 1)) pageBits; base \<le> base + (2 ^ bits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<and> (base \<le> p && ~~ (2 ^ pageBits - 1) \<longrightarrow> \<not> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<longrightarrow> base \<le> p && ~~ (2 ^ pageBits - 1) \<and> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some ko; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<or> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s; (p && ~~ (2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1) = p && ~~ (2 ^ pageBits - 1)) = (p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) - 1); is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<longrightarrow> \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {} \<or> \<not> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; is_aligned (p && ~~ (2 ^ pageBits - 1)) pageBits; base \<le> base + (2 ^ bits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + (2 ^ pageBits - 1); {base..base + 2 ^ bits - 1} \<inter> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} = {} \<or> {base..base + 2 ^ bits - 1} \<subseteq> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<or> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<subseteq> {base..base + 2 ^ bits - 1}\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> koTypeOf ko = UserDataDeviceT \<and> ps_clear (p && ~~ (2 ^ pageBits - 1)) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s \<and> (base \<le> p && ~~ (2 ^ pageBits - 1) \<longrightarrow> \<not> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1)) proof (prove)
goal (2 subgoals):
 1. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); base \<le> p && ~~ (2 ^ pageBits - 1) \<and> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some KOUserData; ps_clear (p && ~~ (2 ^ pageBits - 1)) pageBits s; p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1; is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {}; is_aligned (p && ~~ (2 ^ pageBits - 1)) pageBits; base \<le> base + (2 ^ bits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + (2 ^ pageBits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<longrightarrow> base \<le> base + 2 ^ bits - 1 \<longrightarrow> p && ~~ (2 ^ pageBits - 1) \<le> base + 2 ^ bits - 1 \<longrightarrow> p && ~~ (2 ^ pageBits - 1) \<le> base \<and> base + 2 ^ bits - 1 \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<or> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<le> base + 2 ^ bits - 1; ko = KOUserData\<rbrakk> \<Longrightarrow> False
 2. \<And>p ko. \<lbrakk>base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1); underlying_memory (ksMachineState s) p \<noteq> 0; ksPSpace s (p && ~~ (2 ^ pageBits - 1)) = Some KOUserDataDevice; ps_clear (p && ~~ (2 ^ pageBits - 1)) pageBits s; p && ~~ (2 ^ pageBits - 1) \<le> p \<and> p \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1; is_aligned base bits; bits < word_bits; base \<noteq> 0; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> {base..base + 2 ^ bits - 1} \<subset> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<and> {p && ~~ (2 ^ pageBits - 1)..(p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1} \<inter> (if idx < 2 ^ bits then {base + word_of_nat idx..base + 2 ^ bits - 1} else {}) = {}; is_aligned (p && ~~ (2 ^ pageBits - 1)) pageBits; base \<le> base + (2 ^ bits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + (2 ^ pageBits - 1); p && ~~ (2 ^ pageBits - 1) \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<longrightarrow> base \<le> base + 2 ^ bits - 1 \<longrightarrow> base \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<longrightarrow> p && ~~ (2 ^ pageBits - 1) \<le> base + 2 ^ bits - 1 \<longrightarrow> p && ~~ (2 ^ pageBits - 1) \<le> base \<and> base + 2 ^ bits - 1 \<le> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<or> base \<le> p && ~~ (2 ^ pageBits - 1) \<and> (p && ~~ (2 ^ pageBits - 1)) + 2 ^ pageBits - 1 \<le> base + 2 ^ bits - 1; ko = KOUserDataDevice\<rbrakk> \<Longrightarrow> base \<le> p && ~~ (2 ^ pageBits - 1) \<longrightarrow> \<not> p && ~~ (2 ^ pageBits - 1) \<le> base + (2 ^ bits - 1) proof (prove)
goal:
No subgoals! proof (state)
this:
valid_machine_state' (ksMachineState_update (underlying_memory_update (\<lambda>m x. if base \<le> x \<and> x \<le> base + (2 ^ bits - 1) then 0 else m x)) state')

goal (5 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_not_inQ state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 5. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
sch_act_simple s
ct_not_inQ s proof (prove)
using this:
sch_act_simple s
ct_not_inQ s

goal (1 subgoal):
 1. ct_not_inQ state' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); obj_at' ((\<lambda>ko. active' (itcbState (tcb_to_itcb' ko))) and Not \<circ> tcbQueued) (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>ko. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj\<rbrakk> \<Longrightarrow> live' ko
 2. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj)\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 2. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (9 subgoals):
 1. \<And>obj x11 x12. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 2. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); awaiting_reply' (tcbState obj)\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 3. \<And>obj x3. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 4. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 5. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 6. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); idle' (tcbState obj)\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 7. \<And>obj x71 x72 x73 x74 x75. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 8. \<And>obj. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; active' (tcbState obj); \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive \<or> idle' (tcbState obj); tcbState obj = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> \<exists>y. tcbBoundNotification obj = Some y
 9. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sch_act_simple s; ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ksCurThread s \<le> base + (2 ^ bits - 1); ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> \<not> tcbQueued obj) (ksCurThread s) s; ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
ct_not_inQ state'

goal (4 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ct_idle_or_in_cur_domain' state'
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 4. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
ct_idle_or_in_cur_domain' s proof (prove)
using this:
ct_idle_or_in_cur_domain' s

goal (1 subgoal):
 1. ct_idle_or_in_cur_domain' state' proof (prove)
goal (1 subgoal):
 1. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s \<Longrightarrow> ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s \<and> (base \<le> ksCurThread s \<longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread\<rbrakk> \<Longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s \<and> (base \<le> ksCurThread s \<longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1)) proof (prove)
goal (3 subgoals):
 1. ksSchedulerAction s = ResumeCurrentThread \<Longrightarrow> ksSchedulerAction s = ResumeCurrentThread
 2. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; ksCurThread s = ksIdleThread s\<rbrakk> \<Longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s \<and> (base \<le> ksCurThread s \<longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1))
 3. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s\<rbrakk> \<Longrightarrow> ksCurThread s = ksIdleThread s \<or> obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s \<and> (base \<le> ksCurThread s \<longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s\<rbrakk> \<Longrightarrow> base \<le> ksCurThread s \<longrightarrow> ksCurThread s = ksIdleThread s \<or> \<not> ksCurThread s \<le> base + (2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s; base \<le> ksCurThread s\<rbrakk> \<Longrightarrow> ksCurThread s = ksIdleThread s \<or> \<not> ksCurThread s \<le> base + (2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; obj_at' (\<lambda>tcb. ksCurDomain s = tcbDomain tcb) (ksCurThread s) s; base \<le> ksCurThread s\<rbrakk> \<Longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; obj_at' (active' \<circ> tcbState and (\<lambda>tcb. ksCurDomain s = tcbDomain tcb)) (ksCurThread s) s\<rbrakk> \<Longrightarrow> \<not> ksCurThread s \<le> base + (2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>ko. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj\<rbrakk> \<Longrightarrow> live' ko
 2. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 2. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (9 subgoals):
 1. \<And>obj x11 x12. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.BlockedOnReceive x11 x12\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 2. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; awaiting_reply' (tcbState obj)\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 3. \<And>obj x3. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.BlockedOnNotification x3\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 4. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Running\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 5. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Inactive\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 6. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; idle' (tcbState obj)\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 7. \<And>obj x71 x72 x73 x74 x75. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.BlockedOnSend x71 x72 x73 x74 x75\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 8. \<And>obj. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obja. ko = KOTCB obja \<and> active' (tcbState obja) \<and> tcbDomain obj = tcbDomain obja) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); active' (tcbState obj); ksCurDomain s = tcbDomain obj; tcbBoundNotification obj = None; \<not> tcbQueued obj; tcbState obj = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState
 9. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ksSchedulerAction s = ResumeCurrentThread; base \<le> ksCurThread s; ko_wp_at' (\<lambda>ko. \<exists>obj. ko = KOTCB obj \<and> active' (tcbState obj) \<and> ksCurDomain s = tcbDomain obj) (ksCurThread s) s; ksCurThread s \<le> base + (2 ^ bits - 1); ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
ct_idle_or_in_cur_domain' state'

goal (3 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> ksCurDomain s \<le> maxDomain
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 3. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
ksCurDomain s \<le> maxDomain proof (prove)
using this:
ksCurDomain s \<le> maxDomain

goal (1 subgoal):
 1. ksCurDomain s \<le> maxDomain proof (state)
this:
ksCurDomain s \<le> maxDomain

goal (2 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (chain)
picking this:
invs' s proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. untyped_ranges_zero' s proof (state)
this:
untyped_ranges_zero' s

goal (2 subgoals):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined))\<rbrakk> \<Longrightarrow> untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (prove)
goal (1 subgoal):
 1. untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s) proof (prove)
goal (1 subgoal):
 1. \<forall>a b. (\<exists>p. cte_wp_at' (\<lambda>cte. untypedZeroRange (cteCap cte) = Some (a, b)) p s \<and> (base \<le> p \<longrightarrow> \<not> p \<le> base + (2 ^ bits - 1))) = (\<exists>p. cte_wp_at' (\<lambda>cte. untypedZeroRange (cteCap cte) = Some (a, b)) p s) proof (prove)
goal (1 subgoal):
 1. \<And>a b x. (cte_wp_at' (\<lambda>cte. untypedZeroRange (cteCap cte) = Some (a, b)) x s \<and> (base \<le> x \<longrightarrow> \<not> x \<le> base + (2 ^ bits - 1))) = cte_wp_at' (\<lambda>cte. untypedZeroRange (cteCap cte) = Some (a, b)) x s proof (prove)
goal (1 subgoal):
 1. \<And>a b x. \<lbrakk>cte_wp_at' (\<lambda>cte. untypedZeroRange (cteCap cte) = Some (a, b)) x s; base \<le> x; x \<le> base + (2 ^ bits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>a b x c. \<lbrakk>base \<le> x; x \<le> base + (2 ^ bits - 1); untypedZeroRange (cteCap c) = Some (a, b)\<rbrakk> \<Longrightarrow> cteCap c \<noteq> capability.NullCap
 2. \<And>a b x. \<lbrakk>base \<le> x; x \<le> base + (2 ^ bits - 1); x \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>a b x. \<lbrakk>base \<le> x; x \<le> base + (2 ^ bits - 1); x \<notin> base_bits\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_ranges_zero_inv (cteCaps_of state') (gsUntypedZeroRanges s)

goal (1 subgoal):
 1. \<lbrakk>ksDomSchedule s \<noteq> []; ksDomSchedule s \<noteq> []; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; \<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); ksDomSchedule (KernelInit_H.newKernelState undefined) = []\<rbrakk> \<Longrightarrow> False