theory Retype_C

lemma copyGlobalMappings_ccorres:
  "ccorres dc xfdc
     (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s)
        and page_directory_at' pd and (\<lambda>_. is_aligned pd pdBits))
     (UNIV \<inter> {s. newPD_' s = Ptr pd}) []
    (copyGlobalMappings pd) (Call copyGlobalMappings_'proc)" apply (rule ccorres_gen_asm) apply (cinit lift: newPD_' simp: ARMSectionBits_def pdeBits_def) apply (rule ccorres_h_t_valid_armKSGlobalPD) apply csymbr apply (simp add: pptrBase_def ARM.pptrBase_def objBits_simps archObjSize_def
                    whileAnno_def word_sle_def word_sless_def
                    Collect_True              del: Collect_const) apply (rule ccorres_pre_gets_armKSGlobalPD_ksArchState) apply csymbr apply (rule ccorres_rel_imp) apply (rule_tac F="\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s)
                                \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s
                                \<and> page_directory_at' pd s
                                \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s"
                and i="0xE00"
             in ccorres_mapM_x_while') apply (clarsimp simp del: Collect_const) apply (rule ccorres_guard_imp2) apply (rule ccorres_pre_getObject_pde) apply (simp add: storePDE_def del: Collect_const) apply (rule_tac P="\<lambda>s. ko_at' rv (armKSGlobalPD (ksArchState s)
                                              + ((0xE00 + of_nat n) << 2)) s
                                    \<and> page_directory_at' pd s \<and> valid_pde_mappings' s
                                    \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s"
                    and P'="{s. i_' s = of_nat (3584 + n)
                                    \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits}"
                    in setObject_ccorres_helper) apply (rule conseqPre, vcg) apply (simp add: upto_enum_word del: upt.simps) apply (clarsimp simp: shiftl_t2n field_simps rf_sr_armKSGlobalPD) apply (frule_tac pd=pd in page_directory_at_rf_sr, simp) apply (frule_tac pd="symbol_table a" for a in page_directory_at_rf_sr, simp) apply (rule cmap_relationE1[OF rf_sr_cpde_relation],
                  assumption, erule_tac ko=ko' in ko_at_projectKO_opt) apply (rule cmap_relationE1[OF rf_sr_cpde_relation],
                  assumption, erule_tac ko=rv in ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps') apply (drule(1) page_directory_at_rf_sr)+ apply clarsimp apply (subst array_ptr_valid_array_assertionI[where p="Ptr pd" and q="Ptr pd"],
             erule h_t_valid_clift; simp) apply (simp add: unat_def[symmetric] unat_word_ariths unat_of_nat pdBits_def pageBits_def pdeBits_def) apply (subst array_ptr_valid_array_assertionI[where q="Ptr (symbol_table x)" for x],
             erule h_t_valid_clift; simp) apply (simp add: unat_def[symmetric] unat_word_ariths unat_of_nat pdBits_def pageBits_def pdeBits_def) apply (clarsimp simp: rf_sr_def cstate_relation_def
                                 Let_def typ_heap_simps update_pde_map_tos) apply (rule conjI) apply clarsimp apply (rule conjI) apply (rule disjCI2, erule clift_array_assertionE, simp+) apply (simp only: unat_arith_simps unat_of_nat,
               simp add: pdBits_def pageBits_def pdeBits_def) apply (rule conjI) apply (rule disjCI2, erule clift_array_assertionE, simp+) apply (simp only: unat_arith_simps unat_of_nat,
               simp add: pdBits_def pageBits_def pdeBits_def) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def
                                   typ_heap_simps
                                   update_pde_map_tos
                                   update_pde_map_to_pdes
                                   carray_map_relation_upd_triv) apply (erule(2) cmap_relation_updI) subgoal by simp subgoal by simp apply (clarsimp simp: carch_state_relation_def
                                  cmachine_state_relation_def
                                  typ_heap_simps map_comp_eq
                                  pd_pointer_to_asid_slot_def
                          intro!: ext split: if_split) apply (simp add: field_simps) apply (drule arg_cong[where f="\<lambda>x. x && mask pdBits"],
                   simp add: mask_add_aligned) apply (simp add: iffD2[OF mask_eq_iff_w2p] word_size pdBits_def pageBits_def pdeBits_def) apply (subst(asm) iffD2[OF mask_eq_iff_w2p]) subgoal by (simp add: word_size) apply (simp only: word_shift_by_2) apply (rule shiftl_less_t2n) apply (rule of_nat_power) subgoal by simp subgoal by simp subgoal by simp apply (simp add: word_shift_by_2) apply (drule arg_cong[where f="\<lambda>x. x >> 2"], subst(asm) shiftl_shiftr_id) subgoal by (simp add: word_bits_def) apply (rule of_nat_power) subgoal by (simp add: word_bits_def) subgoal by (simp add: word_bits_def) apply simp apply clarsimp apply (drule(1) valid_pde_mappings_ko_atD')+ apply (clarsimp simp: mask_add_aligned valid_pde_mapping'_def field_simps) apply (subst(asm) field_simps, simp add: mask_add_aligned) apply (simp add: mask_def pdBits_def pageBits_def pdeBits_def
                            valid_pde_mapping_offset'_def pd_asid_slot_def) apply (simp add: obj_at'_def projectKOs fun_upd_idem) apply simp apply (simp add: objBits_simps archObjSize_def pdeBits_def) apply (clarsimp simp: upto_enum_word rf_sr_armKSGlobalPD
                    simp del: upt.simps) apply (simp add: pdBits_def pageBits_def pdeBits_def) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule hoare_pre) apply (wp getObject_valid_pde_mapping' | simp
        | wps storePDE_arch')+ apply (clarsimp simp: mask_add_aligned) apply (simp add: pdBits_def pageBits_def word_bits_def pdeBits_def) apply simp apply (clarsimp simp: word_sle_def page_directory_at'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd and (\<lambda>_. is_aligned pd pdBits)) (UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr pd\<rbrace>) [] (copyGlobalMappings pd) (Call copyGlobalMappings_'proc) proof (prove)
goal (1 subgoal):
 1. is_aligned pd pdBits \<Longrightarrow> ccorres dc xfdc (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr pd\<rbrace>) [] (copyGlobalMappings pd) (Call copyGlobalMappings_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>newPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q500 newPD) (?Q'500 newPD) [SKIP] (do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c armKSGlobalPD_Ptr} (\<acute>global_pd :== pde_Ptr (symbol_table ''armKSGlobalPD''));;
(\<acute>i :== 0xE00;;
WHILE \<acute>i < 0x1000 DO
  IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (newPD +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>global_pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (global_pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>global_pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (newPD +\<^sub>p uint \<acute>i) (h_val (hrs_mem \<acute>t_hrs) (\<acute>global_pd +\<^sub>p uint \<acute>i))))))))))
FI;;
\<acute>i :== \<acute>i + 1
OD))
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q500 newPD s \<and> s' \<in> ?Q'500 newPD proof (prove)
goal (2 subgoals):
 1. \<And>newPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q500 newPD) (?Q'500 newPD) [SKIP] (do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]
od) (\<acute>global_pd :== pde_Ptr (symbol_table ''armKSGlobalPD'');;
(\<acute>i :== 0xE00;;
WHILE \<acute>i < 0x1000 DO
  IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (newPD +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>global_pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (global_pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>global_pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (newPD +\<^sub>p uint \<acute>i) (h_val (hrs_mem \<acute>t_hrs) (\<acute>global_pd +\<^sub>p uint \<acute>i))))))))))
FI;;
\<acute>i :== \<acute>i + 1
OD))
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q500 newPD s \<and> s' \<in> ?Q'500 newPD proof (prove)
goal (2 subgoals):
 1. \<And>newPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q500 newPD) (?G'510 newPD) [SKIP] (do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [pptrBase >> 20 .e. 2 ^ (pdBits - 2) - 1]
od) (\<acute>i :== 0xE00;;
WHILE \<acute>i < 0x1000 DO
  IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (newPD +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_Ptr (symbol_table ''armKSGlobalPD'') +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion newPD (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (newPD +\<^sub>p uint \<acute>i) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'') +\<^sub>p uint \<acute>i))))))))))
FI;;
\<acute>i :== \<acute>i + 1
OD)
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q500 newPD s \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> ?G'510 newPD} proof (prove)
goal (2 subgoals):
 1. \<And>newPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q500 (pde_Ptr pd)) (?G'510 (pde_Ptr pd)) [SKIP] (do globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [0xE00 .e. 2 ^ (pdBits - 2) - 1]
od) (\<acute>i :== 0xE00;;
While \<lbrace>\<acute>i < 0x1000\<rbrace> (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI;;
\<acute>i :== \<acute>i + 1))
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q500 newPD s \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> ?G'510 newPD} proof (prove)
goal (2 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P607 (pde_Ptr pd) a globalPD) (?P'608 globalPD) [SKIP] (mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [0xE00 .e. 2 ^ (pdBits - 2) - 1]) (\<acute>i :== 0xE00;;
While \<lbrace>\<acute>i < 0x1000\<rbrace> (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI;;
\<acute>i :== \<acute>i + 1))
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> ?P607 newPD s rv) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> ?G'510 newPD}
flex-flex pairs:
?P'608 (ptr_val armKSGlobalPD_Ptr) \<equiv>\<^sup>? ?G'510 (pde_Ptr pd) proof (prove)
goal (2 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P614 (pde_Ptr pd) globalPD) (?G'622 globalPD) [SKIP] (mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [0xE00 .e. 2 ^ (pdBits - 2) - 1]) (While \<lbrace>\<acute>i < 0x1000\<rbrace> (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI;;
\<acute>i :== \<acute>i + 1))
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> ?P614 newPD rv s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> ?G'623 newPD}}
flex-flex pairs:
?G'623 (pde_Ptr pd) \<equiv>\<^sup>? ?G'622 (ptr_val armKSGlobalPD_Ptr) proof (prove)
goal (3 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres (?r'719 newPD globalPD) (?xf'719 newPD globalPD) (?P614 (pde_Ptr pd) globalPD) (?G'622 globalPD) [SKIP] (mapM_x (\<lambda>index. getObject (globalPD + (index << 2)) >>= storePDE (pd + (index << 2))) [0xE00 .e. 2 ^ (pdBits - 2) - 1]) (While \<lbrace>\<acute>i < 0x1000\<rbrace> (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI;;
\<acute>i :== \<acute>i + 1))
 2. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; ?r'719 newPD globalPD x (?xf'719 newPD globalPD y)\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> ?P614 newPD rv s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> ?G'623 newPD}}
flex-flex pairs:
?G'623 (pde_Ptr pd) \<equiv>\<^sup>? ?G'622 (ptr_val armKSGlobalPD_Ptr) proof (prove)
goal (7 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>n<length [0xE00 .e. 2 ^ (pdBits - 2) - 1]. ccorres dc xfdc (\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<lbrace>\<acute>i = word_of_nat 3584 + word_of_nat n\<rbrace> [SKIP] (getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI)
 2. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 5. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 6. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (7 subgoals):
 1. \<And>globalPD n. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace> [SKIP] (getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI)
 2. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 5. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 6. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>globalPD n. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q730 globalPD n) (?Q'730 globalPD n) [SKIP] (getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI)
 2. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q730 globalPD n s \<and> s' \<in> ?Q'730 globalPD n
 3. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 4. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 7. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>globalPD n rv. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P733 globalPD n rv) (?P'733 globalPD n rv) [SKIP] (storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) rv) (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI)
 2. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ?P733 globalPD n pde s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'733 globalPD n pde}
 3. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 4. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 7. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>globalPD n rv. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P733 globalPD n rv) (?P'733 globalPD n rv) [SKIP] (setObject (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) rv) (IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI)
 2. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ?P733 globalPD n pde s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'733 globalPD n pde}
 3. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 4. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 7. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>globalPD n rv \<sigma> ko'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' rv (armKSGlobalPD (ksArchState \<sigma>) + (0xE00 + word_of_nat n << 2)) \<sigma> \<and> page_directory_at' pd \<sigma> \<and> valid_pde_mappings' \<sigma> \<and> page_directory_at' (armKSGlobalPD (ksArchState \<sigma>)) \<sigma>) \<and> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace> \<and> ko_at' ko' (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<sigma>} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2) \<mapsto> injectKOS rv)\<rparr>, s) \<in> rf_sr}
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>globalPD n rv \<sigma> ko'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' rv (armKSGlobalPD (ksArchState \<sigma>) + (0xE00 + word_of_nat n << 2)) \<sigma> \<and> page_directory_at' pd \<sigma> \<and> valid_pde_mappings' \<sigma> \<and> page_directory_at' (armKSGlobalPD (ksArchState \<sigma>)) \<sigma>) \<and> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace> \<and> ko_at' ko' (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<sigma>} \<subseteq> {s. (i_' s \<noteq> 0xFF0 \<longrightarrow> (i_' s = 0 \<or> array_assertion (pde_Ptr pd) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2) \<mapsto> injectKOS rv)\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + i_' s * 4)) (h_val (hrs_mem (t_hrs_' (globals s))) (pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)))))) s) \<in> rf_sr) \<and> (\<not> i_' s \<noteq> 0xFF0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2) \<mapsto> injectKOS rv)\<rparr>, s) \<in> rf_sr)}
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> ko_at' rv (armKSGlobalPD (ksArchState \<sigma>) + (0xE00 + word_of_nat n << 2)) \<sigma> \<and> page_directory_at' pd \<sigma> \<and> valid_pde_mappings' \<sigma> \<and> page_directory_at' (armKSGlobalPD (ksArchState \<sigma>)) \<sigma> \<and> i_' s = 0xE00 + word_of_nat n \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits \<and> ko_at' ko' (pd + (0xE00 + word_of_nat n << 2)) \<sigma>} \<subseteq> {s. (i_' s \<noteq> 0xFF0 \<longrightarrow> (i_' s = 0 \<or> array_assertion (pde_Ptr pd) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (i_' s = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (0xE00 + word_of_nat n << 2) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + i_' s * 4)) (h_val (hrs_mem (t_hrs_' (globals s))) (pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)))))) s) \<in> rf_sr) \<and> (i_' s = 0xFF0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (0xE00 + word_of_nat n << 2) \<mapsto> KOArch (KOPDE rv))\<rparr>, s) \<in> rf_sr)}
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) (h_val (hrs_mem (t_hrs_' (globals x))) (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))))))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; cslift x (pd_Ptr pd) \<noteq> None\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) (h_val (hrs_mem (t_hrs_' (globals x))) (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))))))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; cslift x (pd_Ptr pd) \<noteq> None; cslift x armKSGlobalPD_Ptr \<noteq> None\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) (h_val (hrs_mem (t_hrs_' (globals x))) (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))))))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; cslift x (pd_Ptr pd) \<noteq> None; cslift x armKSGlobalPD_Ptr \<noteq> None; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) (h_val (hrs_mem (t_hrs_' (globals x))) (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))))))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; cslift x (pd_Ptr pd) \<noteq> None; cslift x armKSGlobalPD_Ptr \<noteq> None; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> x \<Turnstile>\<^sub>c pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) (h_val (hrs_mem (t_hrs_' (globals x))) (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))))))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; page_directory_at' pd \<sigma>; valid_pde_mappings' \<sigma>; page_directory_at' (symbol_table ''armKSGlobalPD'') \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cslift x (pd_Ptr pd) \<noteq> None; cslift x armKSGlobalPD_Ptr \<noteq> None\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> unat (word_of_nat n + 0xE00) \<le> 4096
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (word_of_nat n + 0xE00)) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> unat (word_of_nat n + 0xE00) \<le> 4096
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (\<sigma>, x) \<in> rf_sr; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a))) x) \<in> rf_sr) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))\<rparr>, x) \<in> rf_sr)
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> (word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))) \<and> (word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n \<noteq> 0x1F0 \<longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; word_of_nat n + 0xE00 \<noteq> 0\<rbrakk> \<Longrightarrow> unat (word_of_nat n + 0xE00) \<le> 4095
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> (word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))) \<and> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> word_of_nat n + 0xE00 = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (word_of_nat n + 0xE00))) (hrs_htd (t_hrs_' (globals x)))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; word_of_nat n + 0xE00 \<noteq> 0\<rbrakk> \<Longrightarrow> unat (word_of_nat n + 0xE00) \<le> 4095
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x))) \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a) (t_hrs_' (globals x)))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((map_to_pdes (ksPSpace \<sigma>))(pd + (word_of_nat n * 4 + 0x3800) \<mapsto> rv)) ((cslift x)(pde_Ptr (pd + (word_of_nat n * 4 + 0x3800)) \<mapsto> y'a)) pde_Ptr cpde_relation
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cpde_relation rv y'a
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj pde_Ptr
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd pdBits; n_ < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv_ (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko'_ (pd + (word_of_nat n_ * 4 + 0x3800)) \<sigma>_; map_to_pdes (ksPSpace \<sigma>_) (pd + (word_of_nat n_ * 4 + 0x3800)) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + (word_of_nat n_ * 4 + 0x3800))) = Some y'_; map_to_pdes (ksPSpace \<sigma>_) (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cpde_relation rv_ y'a_ proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj pde_Ptr
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd pdBits; n_ < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv_ (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko'_ (pd + (word_of_nat n_ * 4 + 0x3800)) \<sigma>_; map_to_pdes (ksPSpace \<sigma>_) (pd + (word_of_nat n_ * 4 + 0x3800)) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + (word_of_nat n_ * 4 + 0x3800))) = Some y'_; map_to_pdes (ksPSpace \<sigma>_) (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> inj pde_Ptr proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) y'a)) (globals x))
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); 0x7C0 + xa = pd + word_of_nat n * 4; is_aligned xa pdBits\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); xa + 0x7C0 = pd + word_of_nat n * 4; is_aligned xa pdBits\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa pdBits; 0x7C0 && mask pdBits = word_of_nat n * 4 && mask pdBits\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 && mask 14 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 < size (word_of_nat n * 4)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n * 4 < 2 ^ 14
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + (word_of_nat n_ * 4 + 0x3800)) \<sigma>_; (case ksPSpace \<sigma>_ (pd + (word_of_nat n_ * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + (word_of_nat n_ * 4 + 0x3800))) = Some y'_; (case ksPSpace \<sigma>_ (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (word_of_nat n_ * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> 14 < size (word_of_nat n_ * 4) proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n * 4 < 2 ^ 14
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n << 2 < 2 ^ 14
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (14 - 2)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> n < 2 ^ (14 - 2)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 - 2 < LENGTH(32)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 5. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 7. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 8. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + ((word_of_nat n_ << 2) + 0x3800)) \<sigma>_; (case ksPSpace \<sigma>_ (pd + ((word_of_nat n_ << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + ((word_of_nat n_ << 2) + 0x3800))) = Some y'_; (case ksPSpace \<sigma>_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> n_ < 2 ^ (14 - 2) proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 - 2 < LENGTH(32)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + ((word_of_nat n_ << 2) + 0x3800)) \<sigma>_; (case ksPSpace \<sigma>_ (pd + ((word_of_nat n_ << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + ((word_of_nat n_ << 2) + 0x3800))) = Some y'_; (case ksPSpace \<sigma>_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> 14 - 2 < LENGTH(32) proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + ((word_of_nat n << 2) + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + ((word_of_nat n << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + ((word_of_nat n << 2) + 0x3800))) = Some y'; (case ksPSpace \<sigma> ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr ((word_of_nat n << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 14 < LENGTH(32)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + ((word_of_nat n_ << 2) + 0x3800)) \<sigma>_; (case ksPSpace \<sigma>_ (pd + ((word_of_nat n_ << 2) + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + ((word_of_nat n_ << 2) + 0x3800))) = Some y'_; (case ksPSpace \<sigma>_ ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr ((word_of_nat n_ << 2) + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> 14 < LENGTH(32) proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; (case ksPSpace \<sigma> (pd + (word_of_nat n * 4 + 0x3800)) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; (case ksPSpace \<sigma> (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n * 4 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n << 2 = 0x7C0\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> 2 < LENGTH(32)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (LENGTH(32) - 2)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n = 0x7C0 >> 2\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + 0x3FC0) \<sigma>_; (case ksPSpace \<sigma>_ (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + 0x3FC0)) = Some y'_; (case ksPSpace \<sigma>_ (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> 2 < LENGTH(32) proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> word_of_nat n < 2 ^ (LENGTH(32) - 2)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n = 0x7C0 >> 2\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> n < 2 ^ (LENGTH(32) - 2)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> LENGTH(32) - 2 < LENGTH(32)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n = 0x7C0 >> 2\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 4. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 6. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 7. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + 0x3FC0) \<sigma>_; (case ksPSpace \<sigma>_ (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + 0x3FC0)) = Some y'_; (case ksPSpace \<sigma>_ (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> n_ < 2 ^ (LENGTH(32) - 2) proof (prove)
goal (12 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14\<rbrakk> \<Longrightarrow> LENGTH(32) - 2 < LENGTH(32)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n = 0x7C0 >> 2\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 3. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 5. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 6. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 10. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_aligned pd 14; n_ < 512; ko_at' rv_ (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>_; valid_pde_mappings' \<sigma>_; i_' x_ = word_of_nat n_ + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko'_ (pd + 0x3FC0) \<sigma>_; (case ksPSpace \<sigma>_ (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'_; cpde_relation ko'_ y'_; cslift x_ (pde_Ptr (pd + 0x3FC0)) = Some y'_; (case ksPSpace \<sigma>_ (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv_; cpde_relation rv_ y'a_; cslift x_ (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a_; cslift x_ (pd_Ptr pd) = Some y_; cslift x_ armKSGlobalPD_Ptr = Some ya_; cpspace_relation (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_)) (t_hrs_' (globals x_)); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>_) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; word_of_nat n_ \<noteq> 0x1F0; armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x_) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); is_aligned xa_ 14\<rbrakk> \<Longrightarrow> LENGTH(32) - 2 < LENGTH(32) proof (prove)
goal (11 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya xa. \<lbrakk>is_aligned pd 14; n < 512; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') 14; ko_at' ko' (pd + 0x3FC0) \<sigma>; (case ksPSpace \<sigma> (pd + 0x3FC0) of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; (case ksPSpace \<sigma> (0x3FC0 + symbol_table ''armKSGlobalPD'') of None \<Rightarrow> None | Some x \<Rightarrow> projectKO_opt x) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (case_option None projectKO_opt \<circ> ksPSpace \<sigma>) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n \<noteq> 0x1F0; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (case_option None (case_option None pde_stored_asid \<circ> cslift x) \<circ> pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); is_aligned xa 14; word_of_nat n = 0x7C0 >> 2\<rbrakk> \<Longrightarrow> set_option (case cslift x (pde_Ptr (xa + 0x3FC0)) of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (pde_stored_asid y'a)
 2. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 4. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 5. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 9. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 10. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) \<sigma>; valid_pde_mappings' \<sigma>; i_' x = word_of_nat n + 0xE00; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + (word_of_nat n * 4 + 0x3800)) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + (word_of_nat n * 4 + 0x3800)) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + (word_of_nat n * 4 + 0x3800))) = Some y'; map_to_pdes (ksPSpace \<sigma>) (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD'')) = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (word_of_nat n * 4 + (0x3800 + symbol_table ''armKSGlobalPD''))) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> word_of_nat n = 0x1F0 \<longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; valid_pde_mappings' \<sigma>; i_' x = 0xFF0; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; ko_at' ko' (pd + 0x3FC0) \<sigma>; map_to_pdes (ksPSpace \<sigma>) (pd + 0x3FC0) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; map_to_pdes (ksPSpace \<sigma>) (0x3FC0 + symbol_table ''armKSGlobalPD'') = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n = 0x1F0\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; valid_pde_mappings' \<sigma>; i_' x = 0xFF0; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; map_to_pdes (ksPSpace \<sigma>) (pd + 0x3FC0) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; map_to_pdes (ksPSpace \<sigma>) (0x3FC0 + symbol_table ''armKSGlobalPD'') = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n = 0x1F0; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma> \<and> valid_pde_mapping' (0x3FC0 + symbol_table ''armKSGlobalPD'' && mask pdBits) rv; ko_at' ko' (pd + 0x3FC0) \<sigma> \<and> valid_pde_mapping' (pd + 0x3FC0 && mask pdBits) ko'\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; valid_pde_mappings' \<sigma>; i_' x = 0xFF0; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; map_to_pdes (ksPSpace \<sigma>) (pd + 0x3FC0) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; map_to_pdes (ksPSpace \<sigma>) (0x3FC0 + symbol_table ''armKSGlobalPD'') = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n = 0x1F0; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; rv = ARM_H.InvalidPDE \<or> valid_pde_mapping_offset' (0x3FC0 + symbol_table ''armKSGlobalPD'' && mask pdBits); ko_at' ko' (pd + 0x3FC0) \<sigma>; ko' = ARM_H.InvalidPDE \<or> valid_pde_mapping_offset' (0x3FC0 && mask pdBits)\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; valid_pde_mappings' \<sigma>; i_' x = 0xFF0; is_aligned (symbol_table ''armKSGlobalPD'') pdBits; map_to_pdes (ksPSpace \<sigma>) (pd + 0x3FC0) = Some ko'; cpde_relation ko' y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; map_to_pdes (ksPSpace \<sigma>) (0x3FC0 + symbol_table ''armKSGlobalPD'') = Some rv; cpde_relation rv y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n = 0x1F0; ko_at' rv (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; rv = ARM_H.InvalidPDE \<or> valid_pde_mapping_offset' (0x3FC0 && mask pdBits); ko_at' ko' (pd + 0x3FC0) \<sigma>; ko' = ARM_H.InvalidPDE \<or> valid_pde_mapping_offset' (0x3FC0 && mask pdBits)\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE rv)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (10 subgoals):
 1. \<And>n rv \<sigma> ko' x y' y'a y ya. \<lbrakk>is_aligned pd 14; n < 512; valid_pde_mappings' \<sigma>; i_' x = 0xFF0; is_aligned (symbol_table ''armKSGlobalPD'') 14; map_to_pdes (ksPSpace \<sigma>) (pd + 0x3FC0) = Some ARM_H.InvalidPDE; cpde_relation ARM_H.InvalidPDE y'; cslift x (pde_Ptr (pd + 0x3FC0)) = Some y'; map_to_pdes (ksPSpace \<sigma>) (0x3FC0 + symbol_table ''armKSGlobalPD'') = Some ARM_H.InvalidPDE; cpde_relation ARM_H.InvalidPDE y'a; cslift x (pde_Ptr (0x3FC0 + symbol_table ''armKSGlobalPD'')) = Some y'a; cslift x (pd_Ptr pd) = Some y; cslift x armKSGlobalPD_Ptr = Some ya; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+size_of TYPE(cte_C) * 256} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; word_of_nat n = 0x1F0; ko_at' ARM_H.InvalidPDE (0x3FC0 + symbol_table ''armKSGlobalPD'') \<sigma>; rv = ARM_H.InvalidPDE; ko_at' ARM_H.InvalidPDE (pd + 0x3FC0) \<sigma>; ko' = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE ARM_H.InvalidPDE))) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(pd + 0x3FC0 \<mapsto> KOArch (KOPDE ARM_H.InvalidPDE)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 3. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 4. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 8. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 9. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> updateObject ko = updateObject_default ko
 2. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 3. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 4. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 5. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 7. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 8. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>globalPD n rv ko. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits ko
 2. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 3. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 4. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 6. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 7. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (7 subgoals):
 1. \<And>globalPD n s s'. \<lbrakk>is_aligned pd pdBits; n < unat (2 ^ (pdBits - 2) - 1) - 3583; (s, s') \<in> rf_sr; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s; s' \<in> \<lbrace>\<acute>i = 0xE00 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) s \<longrightarrow> ko_at' pde (armKSGlobalPD (ksArchState s) + (0xE00 + word_of_nat n << 2)) s \<and> page_directory_at' pd s \<and> valid_pde_mappings' s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2))) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (3584 + n) \<and> is_aligned (symbol_table ''armKSGlobalPD'') pdBits\<rbrace>}
 2. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 5. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 6. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (6 subgoals):
 1. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> (n < 0x1000) = (n < word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1]))
 2. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 4. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 5. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 6. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} IF \<acute>i \<noteq> 0xFF0 THEN
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (pd + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (pd + \<acute>i * 4)) (h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (symbol_table ''armKSGlobalPD'' + \<acute>i * 4)))))))))))
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 4. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>newPD globalPD s. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. (i_' sa \<noteq> 0xFF0 \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr pd) (unat (i_' sa)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c pde_Ptr (pd + i_' sa * 4) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (unat (i_' sa)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c pde_Ptr (symbol_table ''armKSGlobalPD'' + i_' sa * 4) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr pd) (Suc (unat (i_' sa))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr (symbol_table ''armKSGlobalPD'')) (Suc (unat (i_' sa))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s) \<and> (\<not> i_' sa \<noteq> 0xFF0 \<longrightarrow> i_' sa = i_' s)}
 2. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 4. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (4 subgoals):
 1. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 2. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 3. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>newPD globalPD n. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]\<rbrakk> \<Longrightarrow> \<lbrace>?Q987 newPD globalPD n\<rbrace> getObject (globalPD + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) >>= storePDE (pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2)) \<lbrace>\<lambda>_ s. globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrace>
 2. \<And>newPD globalPD n s. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < length [0xE00 .e. 2 ^ (pdBits - 2) - 1]; globalPD = armKSGlobalPD (ksArchState s) \<and> is_aligned globalPD pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrakk> \<Longrightarrow> ?Q987 newPD globalPD n s
 3. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 4. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (4 subgoals):
 1. \<And>newPD n s. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; Suc n < unat (2 ^ (pdBits - 2) - 1) - 3583; is_aligned (armKSGlobalPD (ksArchState s)) pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s\<rbrakk> \<Longrightarrow> armKSGlobalPD (ksArchState s) + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2) && mask pdBits = pd + ([0xE00 .e. 2 ^ (pdBits - 2) - 1] ! n << 2) && mask pdBits
 2. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 3. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>newPD globalPD. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd\<rbrakk> \<Longrightarrow> 3584 + length [0xE00 .e. 2 ^ (pdBits - 2) - 1] < 2 ^ word_bits
 2. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>newPD globalPD x y. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; i_' y = word_of_nat 3584 + word_of_nat (length [0xE00 .e. 2 ^ (pdBits - 2) - 1])\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 2. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal (1 subgoal):
 1. \<And>newPD s s'. \<lbrakk>is_aligned pd pdBits; newPD = pde_Ptr pd; (s, s') \<in> rf_sr; (valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' pd) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. armKSGlobalPD (ksArchState s) = rv \<longrightarrow> rv = armKSGlobalPD (ksArchState s) \<and> is_aligned rv pdBits \<and> valid_pde_mappings' s \<and> page_directory_at' pd s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s) \<and> s' \<in> {s. global_pd_'_update (\<lambda>_. pde_Ptr (symbol_table ''armKSGlobalPD'')) s \<in> {s. i_'_update (\<lambda>_. 0xE00) s \<in> \<lbrace>\<acute>i = word_of_nat 3584\<rbrace>}} proof (prove)
goal:
No subgoals!