theory Detype_C

lemma deleteObjects_ccorres':
  notes if_cong[cong]
  shows
  "ccorres dc xfdc
     (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p and
      (\<lambda>s. descendants_range' (UntypedCap d ptr bits idx) p (ctes_of s)) and
      invs' and ct_active' and sch_act_simple and
      K ( 2 \<le> bits \<and> bits < word_bits))
     UNIV hs
     (deleteObjects ptr bits)
     (Basic (\<lambda>s. globals_update
       (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) \<circ>
        ghost'state_'_update (gs_clear_region ptr bits)) s))" apply (rule ccorres_grab_asm) apply (rule ccorres_name_pre) apply (simp add: deleteObjects_def3 hrs_ghost_update_comm) apply (rule ccorres_assert) apply (rule ccorres_stateAssert_fwd) apply (subst bind_assoc[symmetric]) apply (unfold freeMemory_def) apply (subst ksPSpace_update_ext) apply (subgoal_tac "bits \<le> word_bits") prefer 2 apply (clarsimp simp:cte_wp_at_ctes_of) apply (clarsimp simp: mapM_x_storeWord_step[simplified word_size_bits_def]
             intvl_range_conv intvl_range_conv[where 'a=32, folded word_bits_def]
             doMachineOp_modify modify_modify o_def ksPSpace_ksMSu_comm
             bind_assoc modify_machinestate_assert_cnodes_swap
             modify_modify_bind) apply (rule ccorres_stateAssert_fwd) apply (rule ccorres_stateAssert_after) apply (rule ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: in_monad) apply (rule bexI [rotated]) apply (rule iffD2 [OF in_monad(21)]) apply (rule conjI [OF refl refl]) apply (clarsimp simp: simpler_modify_def) proof - let ?mmu = "(\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)" let ?psu = "(\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x)" fix s s' assume al: "is_aligned ptr bits"
    and cte: "cte_wp_at' (\<lambda>cte. cteCap cte = UntypedCap d ptr bits idx) p s"
    and desc_range: "descendants_range' (UntypedCap d ptr bits idx) p (ctes_of s)"
    and invs: "invs' s" and "ct_active' s"
    and "sch_act_simple s" and wb: "bits < word_bits" and b2: "2 \<le> bits"
    and "deletionIsSafe ptr bits s"
    and cNodePartial: "\<not> cNodePartialOverlap (gsCNodes s)
        (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)"
    and sr: "(s, s') \<in> rf_sr"
    and safe_asids:
          "ksASIDMapSafe
            (gsCNodes_update (\<lambda>_. ?psu (gsCNodes s))
              (gsUserPages_update
                (\<lambda>_. ?psu (gsUserPages s))
                (ksMachineState_update
                  (underlying_memory_update ?mmu)
                  (s\<lparr>ksPSpace := ?psu (ksPSpace s) \<rparr>))))" (is "ksASIDMapSafe ?t") interpret D: delete_locale s ptr bits p apply (unfold_locales) apply fact+ done let ?ks = "?psu (ksPSpace s)" let ?ks' = "ksPSpace s |` (- {ptr..+2 ^ bits})" have psu_restrict: "\<forall>h. ?psu h = h |` (- {ptr..+2 ^ bits})" apply (intro allI ext) apply (subst upto_intvl_eq [OF al]) apply (clarsimp) done have ks': "?ks = ?ks'" by (simp add: psu_restrict) let ?th = "hrs_htd_update (typ_region_bytes ptr bits)" let ?th_s = "?th (t_hrs_' (globals s'))" have map_to_ctes_delete':
    "map_to_ctes ?ks' = ctes_of s |` (- {ptr..+2 ^ bits})" using invs apply (subst ks' [symmetric]) apply (subst map_to_ctes_delete [OF D.valid_untyped, simplified field_simps]) apply clarsimp apply (rule ext) apply (subst upto_intvl_eq [OF al]) apply clarsimp done note cm_disj = cmap_relation_disjoint [OF D.valid_untyped invs, atomize] note cm_disj_tcb = cmap_relation_disjoint_tcb [OF D.valid_untyped invs] note cm_disj_cte = cmap_relation_disjoint_cte [OF D.valid_untyped invs] note cm_disj_user = cmap_relation_disjoint_user_data [OF D.valid_untyped invs] note cm_disj_device = cmap_relation_disjoint_device_data [OF D.valid_untyped invs] have rl: "\<forall>(p :: word32) P. ko_wp_at' P p s \<and>
            (\<forall>ko. P ko \<longrightarrow> live' ko) \<longrightarrow> p \<notin> {ptr..ptr + 2 ^ bits - 1}" apply (intro allI impI conjI) apply (elim conjE) apply (erule D.live_notRange [simplified field_simps]) apply clarsimp done note cmaptcb = cmap_relation_tcb [OF sr] note cmap_array_helper = arg_cong2[where f=carray_map_relation, OF refl map_comp_restrict_map] have trivia: "size_of TYPE(pte_C[256]) = 2 ^ ptBits"
               "size_of TYPE(pde_C[4096]) = 2 ^ pdBits" by (auto simp: ptBits_def pageBits_def pdBits_def pdeBits_def pteBits_def) note cmap_array = cmap_array_typ_region_bytes[where 'a=pte, OF refl _ al _ trivia(1)]
     cmap_array_typ_region_bytes[where 'a=pde, OF refl _ al _ trivia(2)] note cmap_array = cmap_array[simplified, simplified objBitsT_simps b2
        ptBits_def pdBits_def pageBits_def word_bits_def, simplified] note pspace_distinct' = invs_pspace_distinct'[OF invs] and
       pspace_aligned' = invs_pspace_aligned'[OF invs] and
       valid_objs' = invs_valid_objs'[OF invs] and
       valid_untyped'_def2 =
         valid_untyped'[OF pspace_distinct' pspace_aligned' al] have s_ksPSpace_adjust: "ksPSpace_update ?psu s = s\<lparr>ksPSpace := ?psu (ksPSpace s)\<rparr>" by simp from invs have "valid_global_refs' s" by fastforce with cte have ptr_refs: "kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {}" by (fastforce simp: valid_global_refs'_def valid_refs'_def cte_wp_at_ctes_of ran_def) 

  (* calculation starts here *)
   have cs: "cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s))
                             (t_hrs_' (globals s'))" using sr by (clarsimp simp: rf_sr_def cstate_relation_def Let_def) hence "cpspace_relation ?ks' (underlying_memory (ksMachineState s)) ?th_s" unfolding cpspace_relation_def using cendpoint_relation_restrict [OF D.valid_untyped invs rl]
      cnotification_relation_restrict [OF D.valid_untyped invs rl] apply - apply (elim conjE) apply ((subst lift_t_typ_region_bytes,
            rule cm_disj cm_disj_tcb cm_disj_cte cm_disj_user cm_disj_device
            , assumption +,
            simp_all add: objBits_simps' archObjSize_def pageBits_def projectKOs
                          pteBits_def pdeBits_def
                          heap_to_user_data_restrict heap_to_device_data_restrict)[1])+ \<comment> \<open>waiting ...\<close> apply (simp add: map_to_ctes_delete' cmap_relation_restrict_both_proj
                     cmap_relation_restrict_both cmap_array_helper hrs_htd_update
                     ptBits_def pdBits_def pageBits_def cmap_array) apply (intro conjI) apply (frule cmap_relation_restrict_both_proj
                      [where f = tcb_ptr_to_ctcb_ptr]) apply simp apply (erule iffD1[OF cpspace_tcb_relation_address_subset,
                           OF D.valid_untyped invs cmaptcb]) apply (subst cmap_relation_cong [OF refl refl,
                      where rel' = "cendpoint_relation (cslift s')"]) apply (clarsimp simp: restrict_map_Some_iff image_iff
                             map_comp_restrict_map_Some_iff) apply (simp add: cmap_relation_restrict_both_proj) apply (subst cmap_relation_cong[OF refl refl,
                    where rel' = "cnotification_relation (cslift s')"]) apply (clarsimp simp: restrict_map_Some_iff image_iff
                            map_comp_restrict_map_Some_iff) apply (simp add: cmap_relation_restrict_both_proj) apply (rule cmap_array; simp add: pdeBits_def) apply (rule cmap_array; simp add: pteBits_def) done moreover from invs have "valid_queues s" .. hence "\<And>p. \<forall>t \<in> set (ksReadyQueues s p). tcb_at' t s \<and> ko_wp_at' live' t s" apply (clarsimp simp: valid_queues_def valid_queues_no_bitmap_def) apply (drule spec, drule spec) apply clarsimp apply (drule (1) bspec) apply (rule conjI) apply (erule obj_at'_weakenE) apply simp apply (simp add: obj_at'_real_def) apply (erule ko_wp_at'_weakenE) apply (clarsimp simp: projectKOs inQ_def) done hence tat: "\<And>p. \<forall>t \<in> set (ksReadyQueues s p). tcb_at' t s"
    and  tlive: "\<And>p. \<forall>t \<in> set (ksReadyQueues s p). ko_wp_at' live' t s" by auto from sr have
    "cready_queues_relation (clift ?th_s)
        (ksReadyQueues_' (globals s')) (ksReadyQueues s)" unfolding cready_queues_relation_def rf_sr_def cstate_relation_def
              cpspace_relation_def apply (clarsimp simp: Let_def all_conj_distrib) apply (drule spec, drule spec, drule mp) apply fastforce apply ((subst lift_t_typ_region_bytes, rule cm_disj_tcb, assumption+,
      simp_all add: objBits_simps archObjSize_def pageBits_def projectKOs)[1])+
      \<comment> \<open>waiting ...\<close> apply (simp add: tcb_queue_relation_live_restrict
                     [OF D.valid_untyped tat tlive rl]) done moreover { assume asid_map:
    "asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) =
       set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)" hence asid:
      "\<And>p pd_ptr pde. \<lbrakk> cslift s' (pde_Ptr p) = Some pde;
                        pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p);
                        pde_stored_asid pde \<noteq> None \<rbrakk> \<Longrightarrow>
      \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s))" apply - apply (drule_tac x=pd_ptr in fun_cong) apply (clarsimp simp: map_comp_def) apply (clarsimp simp: asid_map_pd_to_hwasids_def) apply (drule equalityD2) apply fastforce done from safe_asids have pds:
      "\<And>p asid pd_ptr. armKSASIDMap (ksArchState (s\<lparr>ksPSpace := ?ks\<rparr>)) p =
                        Some (asid, pd_ptr) \<Longrightarrow>
                        page_directory_at' pd_ptr (s\<lparr>ksPSpace := ?ks\<rparr>)" by (clarsimp simp: ksASIDMapSafe_def) from cs have clift:
      "\<And>p. clift (hrs_htd_update (typ_region_bytes ptr bits)
                                  (t_hrs_' (globals s'))) (p::pde_C ptr) =
           (if p \<in> pde_Ptr ` {ptr..+2 ^ bits} then None else cslift s' p)" apply (subst lift_t_typ_region_bytes[OF cm_disj], simp_all) apply (fastforce simp: cpspace_relation_def) apply (simp add: projectKOs) apply (simp add: objBits_simps archObjSize_def pdeBits_def) done have "set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) =
      set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift ?th_s \<circ>\<^sub>m
            pd_pointer_to_asid_slot)" apply - apply (rule ext) apply (rename_tac pd_ptr) apply (clarsimp simp: map_comp_def) apply (simp add: clift split: option.splits) apply clarsimp apply (rule ccontr) apply (drule (2) asid) apply (clarsimp simp: ran_def pd_pointer_to_asid_slot_def split: if_split_asm) apply (subgoal_tac "armKSASIDMap (ksArchState (s\<lparr>ksPSpace := ?ks\<rparr>)) a = Some (asid, pd_ptr)") prefer 2 apply simp apply (drule pds) apply (subgoal_tac "pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := ?ks\<rparr>)") apply (cut_tac p="pd_ptr + 0x3FC0" in D.typ_at' [of "ArchT PDET", simplified field_simps]) apply (simp add: upto_intvl_eq [OF al]) apply (clarsimp simp: page_directory_at'_def) apply (erule_tac x="0xFF0" in allE) apply simp done } moreover { assume "s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr" moreover from sr ptr_refs have "ptr_span armKSGlobalPD_Ptr
      \<inter> {ptr..ptr + 2 ^ bits - 1} = {}" by (fastforce simp: rf_sr_def cstate_relation_def Let_def) ultimately have "hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr" using al wb apply (cases "t_hrs_' (globals s')") apply (simp add: hrs_htd_update_def hrs_htd_def h_t_valid_typ_region_bytes upto_intvl_eq) done } moreover have h2ud_eq:
       "heap_to_user_data (?psu (ksPSpace s))
                          (?mmu (underlying_memory (ksMachineState s))) =
        heap_to_user_data (?psu (ksPSpace s))
                          (underlying_memory (ksMachineState s))" apply (subst heap_to_user_data_update_region
                 [where S="{ptr..ptr + 2 ^ bits - 1}", simplified]) prefer 2 apply (rule ext) apply clarsimp apply (simp add: map_option_def map_comp_def
              split: if_split_asm option.splits) apply (frule pspace_alignedD'[OF _ pspace_aligned']) apply (case_tac "pageBits \<le> bits") apply (simp add: objBitsKO_def projectKOs  split: kernel_object.splits) apply clarsimp apply (rule aligned_range_offset_mem
       [where 'a=32, folded word_bits_def, simplified, OF _ _ al _ wb]) apply assumption+ apply (rule iffI[rotated], simp) apply (simp add: objBits_simps projectKOs) apply (rule FalseE) apply (case_tac "ptr \<le> x", simp) apply clarsimp apply (frule_tac y="ptr + 2 ^ bits - 1" in le_less_trans) apply (simp only: not_le) apply (drule (1) is_aligned_no_wrap') apply simp apply (cut_tac cte[simplified cte_wp_at_ctes_of]) apply clarsimp apply (frule ctes_of_valid'[OF _ valid_objs']) apply (frule pspace_distinctD'[OF _ pspace_distinct']) apply (clarsimp simp add: valid_cap'_def valid_untyped'_def2 capAligned_def) apply (drule_tac x=x in spec) apply (simp add: obj_range'_def objBitsKO_def) apply (simp only: not_le) apply (cut_tac is_aligned_no_overflow[OF al]) apply (case_tac "ptr \<le> x + 2 ^ pageBits - 1",
           simp_all only: simp_thms not_le) apply clarsimp apply (thin_tac "psp = Some ko" for psp ko)+ apply (thin_tac "ps_clear x y z" for x y z) apply (thin_tac "cteCap x = y" for x y)+ apply (frule is_aligned_no_overflow) apply (simp only: x_power_minus_1) apply (frule_tac x=x in word_plus_strict_mono_right[of _ "2^pageBits"]) apply (rule ccontr) apply (simp only: not_le) apply (frule_tac y="x" in less_le_trans, assumption) apply (simp add: field_simps word_sub_less_iff) apply simp done moreover have h2dd_eq:
       "heap_to_device_data (?psu (ksPSpace s))
                          (?mmu (underlying_memory (ksMachineState s))) =
        heap_to_device_data (?psu (ksPSpace s))
                          (underlying_memory (ksMachineState s))" apply (subst heap_to_device_data_update_region
                 [where S="{ptr..ptr + 2 ^ bits - 1}", simplified]) prefer 2 apply (rule ext) apply clarsimp apply (simp add: map_option_def map_comp_def
              split: if_split_asm option.splits) apply (frule pspace_alignedD'[OF _ pspace_aligned']) apply (case_tac "pageBits \<le> bits") apply (simp add: objBitsKO_def projectKOs  split: kernel_object.splits) apply clarsimp apply (rule aligned_range_offset_mem
       [where 'a=32, folded word_bits_def, simplified, OF _ _ al _ wb]) apply assumption+ apply (rule iffI[rotated], simp) apply (simp add: objBits_simps projectKOs) apply (rule FalseE) apply (case_tac "ptr \<le> x", simp) apply clarsimp apply (frule_tac y="ptr + 2 ^ bits - 1" in le_less_trans) apply (simp only: not_le) apply (drule (1) is_aligned_no_wrap') apply simp apply (cut_tac cte[simplified cte_wp_at_ctes_of]) apply clarsimp apply (frule ctes_of_valid'[OF _ valid_objs']) apply (frule pspace_distinctD'[OF _ pspace_distinct']) apply (clarsimp simp add: valid_cap'_def valid_untyped'_def2 capAligned_def) apply (drule_tac x=x in spec) apply (simp add: obj_range'_def objBitsKO_def) apply (simp only: not_le) apply (cut_tac is_aligned_no_overflow[OF al]) apply (case_tac "ptr \<le> x + 2 ^ pageBits - 1",
           simp_all only: simp_thms not_le) apply clarsimp apply (thin_tac "psp = Some ko" for psp ko)+ apply (thin_tac "ps_clear x y z" for x y z) apply (thin_tac "cteCap x = y" for x y)+ apply (frule is_aligned_no_overflow) apply (simp only: x_power_minus_1) apply (frule_tac x=x in word_plus_strict_mono_right[of _ "2^pageBits"]) apply (rule ccontr) apply (simp only: not_le) apply (frule_tac y="x" in less_le_trans, assumption) apply (simp add: field_simps word_sub_less_iff) apply simp done moreover { from D.valid_untyped invs have tcb_no_overlap:
      "\<And>p v. map_to_tcbs (ksPSpace s) p = Some v
        \<Longrightarrow> p \<notin> {ptr..+2 ^ bits}
        \<Longrightarrow> {p ..+ 2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}" apply (clarsimp simp: valid_cap'_def) apply (drule(1) map_to_ko_atI') apply (clarsimp simp: obj_at'_def valid_untyped'_def2) apply (elim allE, drule(1) mp) apply (clarsimp simp only: obj_range'_def upto_intvl_eq[symmetric] al) apply (subgoal_tac "objBitsKO ko = objBitsT TCBT") apply (subgoal_tac "p \<in> {p ..+ 2 ^ objBitsT TCBT}") apply simp apply blast apply (simp add: upto_intvl_eq) apply (clarsimp simp: objBits_simps projectKOs objBitsT_simps) done note upto_rew = upto_intvl_eq[OF al, THEN eqset_imp_iff, symmetric, simplified] from cNodePartial[simplified upto_rew] have cn_no_overlap:
      "\<And>p n. gsCNodes s p = Some n \<Longrightarrow> p \<notin> {ptr..+2 ^ bits}
          \<Longrightarrow> {p ..+ 2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {}" apply (simp add: cNodePartialOverlap_def) apply (elim allE, drule(1) mp) apply clarsimp apply (frule base_member_set, simp add: word_bits_def) apply (clarsimp simp only: upto_intvl_eq[symmetric] field_simps) apply blast done from sr have "cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr
       (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))"
      "cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr
       (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))" apply (simp_all add: map_comp_restrict_map rf_sr_def cstate_relation_def Let_def) apply (rule cvariable_array_map_relation_detype, clarsimp+) apply (drule(1) cn_no_overlap) apply (simp add: cte_level_bits_def power_add) apply (rule cvariable_array_map_relation_detype, clarsimp+) apply (drule(1) tcb_no_overlap) apply (erule disjoint_subset[rotated]) apply (rule intvl_start_le) apply (simp add: objBitsT_simps objBits_defs) done } moreover from sr have "apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) =
        (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)
        \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s')))
            (gsMaxObjectSize s)" apply (case_tac "ghost'state_' (globals s')") apply (simp add: rf_sr_def cstate_relation_def Let_def gs_clear_region_def
                  upto_intvl_eq[OF al] carch_state_relation_def
                  cmachine_state_relation_def ghost_size_rel_def
                  ghost_assertion_data_get_def restrict_map_def
                  if_flip[symmetric, where F=None]) done moreover from sr have
     "h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
       c_guard intStateIRQNode_array_Ptr" apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (simp add: h_t_valid_typ_region_bytes) apply (simp add: upto_intvl_eq al) apply (rule disjoint_subset[OF _ ptr_refs]) apply (simp add: cinterrupt_relation_def cte_level_bits_def) done ultimately show "(?t, globals_update
               (%x. ghost'state_'_update (gs_clear_region ptr bits)
                      (t_hrs_'_update ?th x)) s') \<in> rf_sr" using sr untyped_cap_rf_sr_ptr_bits_domain[OF cte invs sr] by (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                       psu_restrict cpspace_relation_def
                       carch_state_relation_def cmachine_state_relation_def
                       hrs_htd_update htd_safe_typ_region_bytes
                       zero_ranges_are_zero_typ_region_bytes) qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p and (\<lambda>s. descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> bits \<and> bits < word_bits)) UNIV hs (deleteObjects ptr bits) (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) \<circ> ghost'state_'_update (gs_clear_region ptr bits)) proof (prove)
goal (1 subgoal):
 1. 2 \<le> bits \<and> bits < word_bits \<Longrightarrow> ccorres dc xfdc (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p and (\<lambda>s. descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s)) and invs' and ct_active' and sch_act_simple) UNIV hs (deleteObjects ptr bits) (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) \<circ> ghost'state_'_update (gs_clear_region ptr bits)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p and (\<lambda>s. descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s)) and invs' and ct_active' and sch_act_simple) s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s'. s' = s) UNIV hs (deleteObjects ptr bits) (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) \<circ> ghost'state_'_update (gs_clear_region ptr bits)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s'. s' = s) UNIV hs (do y <- assert (is_aligned ptr bits);
y <- stateAssert (deletionIsSafe ptr bits) [];
y <- doMachineOp (freeMemory ptr bits);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s'. s' = s) UNIV hs (do y <- stateAssert (deletionIsSafe ptr bits) [];
y <- doMachineOp (freeMemory ptr bits);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- doMachineOp (freeMemory ptr bits);
y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) [];
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (freeMemory ptr bits);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + word_size .e. ptr + 2 ^ bits - 1]);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + word_size .e. ptr + 2 ^ bits - 1]);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits; bits \<le> word_bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + word_size .e. ptr + 2 ^ bits - 1]);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)))
 2. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> bits \<le> word_bits proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits\<rbrakk> \<Longrightarrow> bits \<le> word_bits
 2. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits; bits \<le> word_bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + word_size .e. ptr + 2 ^ bits - 1]);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>2 \<le> bits \<and> bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s \<and> descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s) \<and> invs' s \<and> ct_active' s \<and> sch_act_simple s; is_aligned ptr bits; bits \<le> word_bits\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- do y <- doMachineOp (mapM_x (\<lambda>p. storeWord p 0) [ptr , ptr + word_size .e. ptr + 2 ^ bits - 1]);
stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) []
od;
y <- modify (\<lambda>s. s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a, gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== ghost'state_'_update (gs_clear_region ptr bits) \<circ> t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits) UNIV hs (do y <- stateAssert (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) [];
y <- modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits and (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1))) UNIV hs (do y <- modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>);
stateAssert ksASIDMapSafe []
od) (\<acute>globals :== (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s\<rbrakk> \<Longrightarrow> ccorres dc xfdc ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits and (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) and (\<lambda>s. \<forall>(rv, s')\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). ksASIDMapSafe s')) UNIV hs (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>)) (\<acute>globals :== (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {sa. ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits and (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) and (\<lambda>s. \<forall>(rv, s')\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). ksASIDMapSafe s')) \<sigma> \<and> sa \<in> UNIV \<and> (\<sigma>, sa) \<in> rf_sr} \<acute>globals :== (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>s \<sigma>. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s\<rbrakk> \<Longrightarrow> {sa. ((\<lambda>s'. s' = s) and deletionIsSafe ptr bits and (\<lambda>s. \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)) and (\<lambda>s. \<forall>(rv, s')\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). ksASIDMapSafe s')) \<sigma> \<and> sa \<in> UNIV \<and> (\<sigma>, sa) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) \<sigma>). (\<sigma>', globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) s))} proof (prove)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ?x44 s x \<in> fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s)
 2. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> case ?x44 s x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ?s'48 s x = ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr> \<and> ?v48 s x = ()
 2. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> case (?v48 s x, ?s'48 s x) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); \<forall>x\<in>fst (modify (\<lambda>x. ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (x\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace x a\<rparr>)\<lparr>gsUserPages := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsUserPages x xa, gsCNodes := \<lambda>xa. if ptr \<le> xa \<and> xa \<le> ptr + 2 ^ bits - 1 then None else gsCNodes x xa\<rparr>) s). case x of (rv, x) \<Rightarrow> ksASIDMapSafe x; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> case ((), ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
is_aligned ptr bits
cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s
descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s)
invs' s
ct_active' s
sch_act_simple s
bits < word_bits
2 \<le> bits
deletionIsSafe ptr bits s
\<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
(s, s') \<in> rf_sr
ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. delete_locale s ptr bits p idx d proof (prove)
goal (8 subgoals):
 1. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s
 2. descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s)
 3. invs' s
 4. ct_active' s
 5. sch_act_simple s
 6. bits < word_bits
 7. is_aligned ptr bits
 8. deletionIsSafe ptr bits s proof (prove)
goal:
No subgoals! proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<forall>h. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) = h|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
goal (1 subgoal):
 1. \<And>h x. (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) = (h|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) x proof (prove)
goal (1 subgoal):
 1. \<And>h x. (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) = (h|\<^bsub>(- {ptr..ptr + 2 ^ bits - 1})\<^esub>) x proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>h. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) = h|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) = ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (state)
this:
(\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) = ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
goal (1 subgoal):
 1. invs' s \<Longrightarrow> map_to_ctes (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
goal (2 subgoals):
 1. invs' s \<Longrightarrow> pspace_distinct' s
 2. invs' s \<Longrightarrow> (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ctes_of s x) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
goal (1 subgoal):
 1. invs' s \<Longrightarrow> (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ctes_of s x) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub> proof (prove)
goal (1 subgoal):
 1. \<And>x. invs' s \<Longrightarrow> (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ctes_of s x) = (ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) x proof (prove)
goal (1 subgoal):
 1. \<And>x. invs' s \<Longrightarrow> (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ctes_of s x) = (ctes_of s|\<^bsub>(- {ptr..ptr + 2 ^ bits - 1})\<^esub>) x proof (prove)
goal:
No subgoals! proof (state)
this:
map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) = ctes_of s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>cmap_relation (?proj \<circ>\<^sub>m ksPSpace s) (cslift ?s') PTR(?'b) ?rel; ?s' \<Turnstile>\<^sub>c ?x; \<And>ko v. ?proj ko = Some v \<Longrightarrow> koType TYPE(?'a) = koTypeOf ko; ?x \<notin> PTR(?'b) ` {ptr..+2 ^ bits}; size_td (typ_info_t TYPE(?'b)) \<le> 2 ^ objBits undefined\<rbrakk> \<Longrightarrow> ptr_span ?x \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>cmap_relation (map_to_tcbs (ksPSpace s)) (cslift ?s') tcb_ptr_to_ctcb_ptr ctcb_relation; ?s' \<Turnstile>\<^sub>c ?x; ?x \<notin> tcb_Ptr ` {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> ptr_span ?x \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>cmap_relation (ctes_of s) (cslift ?s') cte_Ptr ccte_relation; ?s' \<Turnstile>\<^sub>c ?x; ?x \<notin> cte_Ptr ` {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> ptr_span ?x \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift ?s') PTR(user_data_C) cuser_user_data_relation; ?s' \<Turnstile>\<^sub>c ?x; ?x \<notin> PTR(user_data_C) ` {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> ptr_span ?x \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift ?s') PTR(user_data_device_C) cuser_user_data_device_relation; ?s' \<Turnstile>\<^sub>c ?x; ?x \<notin> PTR(user_data_device_C) ` {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> ptr_span ?x \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<forall>p P. ko_wp_at' P p s \<and> (\<forall>ko. P ko \<longrightarrow> live' ko) \<longrightarrow> p \<notin> {ptr..ptr + 2 ^ bits - 1} proof (prove)
goal (1 subgoal):
 1. \<And>p P. ko_wp_at' P p s \<and> (\<forall>ko. P ko \<longrightarrow> live' ko) \<Longrightarrow> p \<notin> {ptr..ptr + 2 ^ bits - 1} proof (prove)
goal (1 subgoal):
 1. \<And>p P. \<lbrakk>ko_wp_at' P p s; \<forall>ko. P ko \<longrightarrow> live' ko\<rbrakk> \<Longrightarrow> p \<notin> {ptr..ptr + 2 ^ bits - 1} proof (prove)
goal (1 subgoal):
 1. \<And>p P ko. \<lbrakk>\<forall>ko. P ko \<longrightarrow> live' ko; P ko\<rbrakk> \<Longrightarrow> live' ko proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>p P. ko_wp_at' P p s \<and> (\<forall>ko. P ko \<longrightarrow> live' ko) \<longrightarrow> p \<notin> {ptr..ptr + 2 ^ bits - 1}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
carray_map_relation ?a (?f5 \<circ>\<^sub>m ?m5|\<^bsub>?S5\<^esub>) = carray_map_relation ?a ((?f5 \<circ>\<^sub>m ?m5)|\<^bsub>?S5\<^esub>)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. size_of TYPE(pte_C[256]) = 2 ^ ptBits &&& size_of TYPE(pde_C[4096]) = 2 ^ pdBits proof (state)
this:
size_of TYPE(pte_C[256]) = 2 ^ ptBits
size_of TYPE(pde_C[4096]) = 2 ^ pdBits

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>carray_map_relation ptBits ?amap (h_t_valid ?htd c_guard) pt_Ptr; typ_uinfo_t TYPE(pte_C[256]) \<noteq> typ_uinfo_t TYPE(8 word); objBitsT (koType TYPE(ARM_H.pte)) \<le> bits; objBitsT (koType TYPE(ARM_H.pte)) \<le> ptBits; ptBits < word_bits\<rbrakk> \<Longrightarrow> carray_map_relation ptBits (?amap|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits ?htd) c_guard) pt_Ptr
\<lbrakk>carray_map_relation pdBits ?amap (h_t_valid ?htd c_guard) pd_Ptr; typ_uinfo_t TYPE(pde_C[4096]) \<noteq> typ_uinfo_t TYPE(8 word); objBitsT (koType TYPE(ARM_H.pde)) \<le> bits; objBitsT (koType TYPE(ARM_H.pde)) \<le> pdBits; pdBits < word_bits\<rbrakk> \<Longrightarrow> carray_map_relation pdBits (?amap|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits ?htd) c_guard) pd_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
\<lbrakk>carray_map_relation (8 + pteBits) ?amap (h_t_valid ?htd c_guard) pt_Ptr; pteBits < 24\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (?amap|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits ?htd) c_guard) pt_Ptr
\<lbrakk>carray_map_relation (12 + pdeBits) ?amap (h_t_valid ?htd c_guard) pd_Ptr; pdeBits < 20\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (?amap|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits ?htd) c_guard) pd_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
pspace_distinct' s
pspace_aligned' s
valid_objs' s
valid_untyped' ?d ptr bits ?idx s = (\<forall>p ko. ksPSpace s p = Some ko \<longrightarrow> obj_range' p ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' p ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' p ko \<inter> usableUntypedRange (capability.UntypedCap ?d ptr bits ?idx) = {})

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. ksPSpace_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) s = s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr> proof (state)
this:
ksPSpace_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else h x) s = s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
invs' s proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. valid_global_refs' s proof (state)
this:
valid_global_refs' s

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s
valid_global_refs' s proof (prove)
using this:
cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s
valid_global_refs' s

goal (1 subgoal):
 1. kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {} proof (state)
this:
kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) proof (prove)
using this:
(s, s') \<in> rf_sr

goal (1 subgoal):
 1. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) proof (state)
this:
cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
using this:
cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))

goal (1 subgoal):
 1. cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
using this:
cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')) \<and> cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr

goal (1 subgoal):
 1. cmap_relation (map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ep_Ptr (cendpoint_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ntfn_Ptr (cnotification_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_pdes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_device_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pde_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pte_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
using this:
cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')) \<and> cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr
map_to_eps (ksPSpace s) ?p = Some ?ep \<Longrightarrow> cendpoint_relation (cslift ?s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ?ep ?b = cendpoint_relation (cslift ?s') ?ep ?b
map_to_ntfns (ksPSpace s) ?p = Some ?ntfn \<Longrightarrow> cnotification_relation (cslift ?s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ?ntfn ?b = cnotification_relation (cslift ?s') ?ntfn ?b

goal (1 subgoal):
 1. cmap_relation (map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ep_Ptr (cendpoint_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ntfn_Ptr (cnotification_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_pdes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_device_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pde_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pte_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')) \<and> cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ep_Ptr (cendpoint_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ntfn_Ptr (cnotification_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_pdes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_device_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pde_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pte_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ep_Ptr (cendpoint_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ntfn_Ptr (cnotification_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))))) \<and> cmap_relation (map_to_pdes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_device_data_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pde_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pte_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ctes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- cte_Ptr ` {ptr..+2 ^ bits})\<^esub>) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>)) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>)) \<and> cmap_relation (map_to_pdes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- pde_Ptr ` {ptr..+2 ^ bits})\<^esub>) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- pte_Ptr ` {ptr..+2 ^ bits})\<^esub>) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ap_Ptr ` {ptr..+2 ^ bits})\<^esub>) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (cslift s'|\<^bsub>(- PTR(user_data_C) ` {ptr..+2 ^ bits})\<^esub>) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (cslift s'|\<^bsub>(- PTR(user_data_device_C) ` {ptr..+2 ^ bits})\<^esub>) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cpspace_pde_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<and> cpspace_pte_array_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>)) \<and> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>)) \<and> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr \<and> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (5 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 5. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (6 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> bij tcb_ptr_to_ctcb_ptr
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- ?S95)\<^esub>)) (cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` ?S95)\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 5. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 6. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (5 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- ?S95)\<^esub>)) (cslift s'|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` ?S95)\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 5. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (5 subgoals):
 1. \<And>p a a' b b'. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) p = Some a; map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) p = Some a'; (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) (ep_Ptr p) = Some b; (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) a b = cendpoint_relation (cslift s') a' b'
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 5. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ep_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep_Ptr (cendpoint_relation (cslift s'))
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>))
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (4 subgoals):
 1. \<And>p a a' b b'. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) p = Some a; map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) p = Some a'; (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) (ntfn_Ptr p) = Some b; (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) a b = cnotification_relation (cslift s') a' b'
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'))
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 4. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (cslift s'|\<^bsub>(- ntfn_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn_Ptr (cnotification_relation (cslift s'))
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 3. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pd_Ptr
 2. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>p ep s' b. map_to_eps (ksPSpace s) p = Some ep \<Longrightarrow> cendpoint_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ep b = cendpoint_relation (cslift s') ep b; \<And>p ntfn s' b. map_to_ntfns (ksPSpace s) p = Some ntfn \<Longrightarrow> cnotification_relation (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) ntfn b = cnotification_relation (cslift s') ntfn b; cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation (12 + pdeBits) (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr\<rbrakk> \<Longrightarrow> carray_map_relation (8 + pteBits) (map_to_ptes (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) c_guard) pt_Ptr proof (prove)
goal:
No subgoals! proof (state)
this:
cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
invs' s proof (prove)
using this:
invs' s

goal (1 subgoal):
 1. Invariants_H.valid_queues s proof (state)
this:
Invariants_H.valid_queues s

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
using this:
Invariants_H.valid_queues s

goal (1 subgoal):
 1. \<And>p. \<forall>t\<in>set (ksReadyQueues s p). tcb_at' t s \<and> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p and runnable' \<circ> tcbState) t s) \<and> distinct (ksReadyQueues s (d, p)) \<and> (maxDomain < d \<longrightarrow> ksReadyQueues s (d, p) = []) \<and> (maxPriority < p \<longrightarrow> ksReadyQueues s (d, p) = []); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s\<rbrakk> \<Longrightarrow> tcb_at' t s \<and> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; (\<forall>ta\<in>set (ksReadyQueues s (?d5 a b t, ?p7 a b t)). obj_at' (inQ (?d5 a b t) (?p7 a b t) and runnable' \<circ> tcbState) ta s) \<and> distinct (ksReadyQueues s (?d5 a b t, ?p7 a b t)) \<and> (maxDomain < ?d5 a b t \<longrightarrow> ksReadyQueues s (?d5 a b t, ?p7 a b t) = []) \<and> (maxPriority < ?p7 a b t \<longrightarrow> ksReadyQueues s (?d5 a b t, ?p7 a b t) = [])\<rbrakk> \<Longrightarrow> tcb_at' t s \<and> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; \<forall>ta\<in>set (ksReadyQueues s (?d5 a b t, ?p7 a b t)). obj_at' (inQ (?d5 a b t) (?p7 a b t) and runnable' \<circ> tcbState) ta s; distinct (ksReadyQueues s (?d5 a b t, ?p7 a b t)); maxDomain < ?d5 a b t \<longrightarrow> ksReadyQueues s (?d5 a b t, ?p7 a b t) = []; maxPriority < ?p7 a b t \<longrightarrow> ksReadyQueues s (?d5 a b t, ?p7 a b t) = []\<rbrakk> \<Longrightarrow> tcb_at' t s \<and> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; obj_at' (inQ a b and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> tcb_at' t s \<and> ko_wp_at' live' t s proof (prove)
goal (2 subgoals):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; obj_at' (inQ a b and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> tcb_at' t s
 2. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; obj_at' (inQ a b and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> ko_wp_at' live' t s proof (prove)
goal (2 subgoals):
 1. \<And>a b t k. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; (inQ a b and runnable' \<circ> tcbState) k\<rbrakk> \<Longrightarrow> True
 2. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; obj_at' (inQ a b and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; obj_at' (inQ a b and runnable' \<circ> tcbState) t s\<rbrakk> \<Longrightarrow> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj \<and> inQ a b obj \<and> runnable' (tcbState obj)) t s\<rbrakk> \<Longrightarrow> ko_wp_at' live' t s proof (prove)
goal (1 subgoal):
 1. \<And>a b t ko. \<lbrakk>t \<in> set (ksReadyQueues s (a, b)); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; distinct (ksReadyQueues s (a, b)); maxDomain < a \<longrightarrow> ksReadyQueues s (a, b) = []; maxPriority < b \<longrightarrow> ksReadyQueues s (a, b) = []; \<exists>obj. projectKO_opt ko = Some obj \<and> inQ a b obj \<and> runnable' (tcbState obj)\<rbrakk> \<Longrightarrow> live' ko proof (prove)
goal:
No subgoals! proof (state)
this:
\<forall>t\<in>set (ksReadyQueues s ?p4). tcb_at' t s \<and> ko_wp_at' live' t s

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
using this:
\<forall>t\<in>set (ksReadyQueues s ?p4). tcb_at' t s \<and> ko_wp_at' live' t s

goal (1 subgoal):
 1. (\<And>p. \<forall>t\<in>set (ksReadyQueues s p). tcb_at' t s) &&& (\<And>p. \<forall>t\<in>set (ksReadyQueues s p). ko_wp_at' live' t s) proof (state)
this:
\<forall>t\<in>set (ksReadyQueues s ?p4). tcb_at' t s
\<forall>t\<in>set (ksReadyQueues s ?p4). ko_wp_at' live' t s

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
(s, s') \<in> rf_sr proof (prove)
using this:
(s, s') \<in> rf_sr

goal (1 subgoal):
 1. cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s) proof (prove)
using this:
(s, s') \<in> {(s, s'). let cheap = t_hrs_' (globals s') in (cmap_relation (ctes_of s) (clift cheap) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s) cheap \<and> cmap_relation (map_to_eps (ksPSpace s)) (clift cheap) ep_Ptr (cendpoint_relation (clift cheap)) \<and> cmap_relation (map_to_ntfns (ksPSpace s)) (clift cheap) ntfn_Ptr (cnotification_relation (clift cheap)) \<and> cmap_relation (map_to_pdes (ksPSpace s)) (clift cheap) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s)) (clift cheap) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s)) (clift cheap) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s) (underlying_memory (ksMachineState s)) cheap \<and> cpspace_device_data_relation (ksPSpace s) (underlying_memory (ksMachineState s)) cheap \<and> cpspace_pde_array_relation (ksPSpace s) cheap \<and> cpspace_pte_array_relation (ksPSpace s) cheap) \<and> (\<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> (let cqueue = ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio] in sched_queue_relation' (clift cheap) (ksReadyQueues s (qdom, prio)) (head_C cqueue) (StateRelation_C.end_C cqueue))) \<and> (\<not> (UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = [])) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) cheap \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> ptr_span intStateIRQNode_array_Ptr \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> ptr_span armKSGlobalPD_Ptr \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s}

goal (1 subgoal):
 1. \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> (let cqueue = ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio] in sched_queue_relation' (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues s (qdom, prio)) (head_C cqueue) (StateRelation_C.end_C cqueue))) \<and> (\<not> (UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []) proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<forall>qdom prio. UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<and> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<and> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio \<longrightarrow> sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])); \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) proof (prove)
goal (2 subgoals):
 1. \<And>qdom prio. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> ?qdom51 qdom prio \<and> ?qdom51 qdom prio \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<and> UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> ?prio53 qdom prio \<and> ?prio53 qdom prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio
 2. \<And>qdom prio. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; sched_queue_relation' (cslift s') (ksReadyQueues s (?qdom51 qdom prio, ?prio53 qdom prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C (?qdom51 qdom prio) (?prio53 qdom prio)])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C (?qdom51 qdom prio) (?prio53 qdom prio)]))\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio]))\<rbrakk> \<Longrightarrow> sched_queue_relation' (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) proof (prove)
goal (1 subgoal):
 1. \<And>qdom prio. \<lbrakk>cmap_relation (ctes_of s) (cslift s') cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace s)) (cslift s') tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s)) (cslift s') ep_Ptr (cendpoint_relation (cslift s')); cmap_relation (map_to_ntfns (ksPSpace s)) (cslift s') ntfn_Ptr (cnotification_relation (cslift s')); cmap_relation (map_to_pdes (ksPSpace s)) (cslift s') pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s)) (cslift s') pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s)) (cslift s') ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s) (underlying_memory (ksMachineState s))) (cslift s') PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s)) (c_h_t_valid s') pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s)) (c_h_t_valid s') pt_Ptr; \<forall>qdom prio. (UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio \<longrightarrow> qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom \<longrightarrow> UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom \<longrightarrow> \<not> prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio) \<longrightarrow> ksReadyQueues s (qdom, prio) = []; zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; UCAST(32 signed \<rightarrow> 8) minDom \<le> qdom; qdom \<le> UCAST(32 signed \<rightarrow> 8) maxDom; UCAST(32 signed \<rightarrow> 8) seL4_MinPrio \<le> prio; prio \<le> UCAST(32 signed \<rightarrow> 8) seL4_MaxPrio; sched_queue_relation' (cslift s') (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio]))\<rbrakk> \<Longrightarrow> sched_queue_relation' (cslift s'|\<^bsub>(- tcb_Ptr ` {ptr..+2 ^ bits})\<^esub>) (ksReadyQueues s (qdom, prio)) (head_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) (StateRelation_C.end_C (ksReadyQueues_' (globals s').[cready_queues_index_to_C qdom prio])) proof (prove)
goal:
No subgoals! proof (state)
this:
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
using this:
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>p pd_ptr pde. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); pde_stored_asid pde \<noteq> None\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal (1 subgoal):
 1. \<And>p pd_ptr pde. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); pde_stored_asid pde \<noteq> None; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal (1 subgoal):
 1. \<And>p pd_ptr pde. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); pde_stored_asid pde \<noteq> None; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_ptr = (set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)) pd_ptr\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal (1 subgoal):
 1. \<And>p pd_ptr pde y. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_ptr = {y}; pde_stored_asid pde = Some y\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal (1 subgoal):
 1. \<And>p pd_ptr pde y. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); {hwasid. (hwasid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s))} = {y}; pde_stored_asid pde = Some y\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal (1 subgoal):
 1. \<And>p pd_ptr pde y. \<lbrakk>cslift s' (pde_Ptr p) = Some pde; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr p); pde_stored_asid pde = Some y; {y} \<subseteq> {hwasid. (hwasid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s))}\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s)) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>cslift s' (pde_Ptr ?p4) = Some ?pde4; pd_pointer_to_asid_slot ?pd_ptr4 = Some (pde_Ptr ?p4); pde_stored_asid ?pde4 \<noteq> None\<rbrakk> \<Longrightarrow> \<exists>asid. (asid, ?pd_ptr4) \<in> ran (armKSASIDMap (ksArchState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>) proof (prove)
using this:
ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>)

goal (1 subgoal):
 1. \<And>p asid pd_ptr. armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) p = Some (asid, pd_ptr) \<Longrightarrow> page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (state)
this:
armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) ?p4 = Some (?asid4, ?pd_ptr4) \<Longrightarrow> page_directory_at' ?pd_ptr4 (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) proof (prove)
using this:
cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))

goal (1 subgoal):
 1. \<And>p. clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) p = (if p \<in> pde_Ptr ` {ptr..+2 ^ bits} then None else cslift s' p) proof (prove)
goal (3 subgoals):
 1. \<And>p x. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> cmap_relation (?proj1 p x \<circ>\<^sub>m ksPSpace s) (cslift s') pde_Ptr (?rel1 p x)
 2. \<And>p x ko v. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; ?proj1 p x ko = Some v; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> koType TYPE(?'aa1) = koTypeOf ko
 3. \<And>x. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> 4 \<le> 2 ^ objBits undefined proof (prove)
goal (2 subgoals):
 1. \<And>p x ko v. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; projectKO_opt ko = Some v; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> koType TYPE(ARM_H.pde) = koTypeOf ko
 2. \<And>x. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> 4 \<le> 2 ^ objBits undefined proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>s' \<Turnstile>\<^sub>c x; x \<notin> pde_Ptr ` {ptr..+2 ^ bits}; cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s'))\<rbrakk> \<Longrightarrow> 4 \<le> 2 ^ objBits undefined proof (prove)
goal:
No subgoals! proof (state)
this:
clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) ?p4 = (if ?p4 \<in> pde_Ptr ` {ptr..+2 ^ bits} then None else cslift s' ?p4)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot) proof (prove)
goal (1 subgoal):
 1. set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot) proof (prove)
goal (1 subgoal):
 1. \<And>x. (set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)) x = (set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)) x proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr. (set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot)) pd_ptr = (set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)) pd_ptr proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr. set_option (case pd_pointer_to_asid_slot pd_ptr of None \<Rightarrow> None | Some v \<Rightarrow> case cslift s' v of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) = set_option (case pd_pointer_to_asid_slot pd_ptr of None \<Rightarrow> None | Some v \<Rightarrow> case clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) v of None \<Rightarrow> None | Some x \<Rightarrow> pde_stored_asid x) proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr. \<forall>x2 x2a. cslift s' x2 = Some x2a \<longrightarrow> x2 \<in> pde_Ptr ` {ptr..+2 ^ bits} \<longrightarrow> pd_pointer_to_asid_slot pd_ptr = Some x2 \<longrightarrow> pde_stored_asid x2a = None proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a x. \<lbrakk>cslift s' (pde_Ptr x) = Some x2a; x \<in> {ptr..+2 ^ bits}; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr x)\<rbrakk> \<Longrightarrow> pde_stored_asid x2a = None proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a x. \<lbrakk>cslift s' (pde_Ptr x) = Some x2a; x \<in> {ptr..+2 ^ bits}; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr x); pde_stored_asid x2a \<noteq> None\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a x. \<lbrakk>x \<in> {ptr..+2 ^ bits}; pd_pointer_to_asid_slot pd_ptr = Some (pde_Ptr x); pde_stored_asid x2a \<noteq> None; \<exists>asid. (asid, pd_ptr) \<in> ran (armKSASIDMap (ksArchState s))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> False
 2. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) a = Some (asid, pd_ptr) proof (prove)
goal (2 subgoals):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) a = Some (asid, pd_ptr)
 2. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); armKSASIDMap (ksArchState (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)) a = Some (asid, pd_ptr)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>); pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> False
 2. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>); pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>); pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) = (pde_at' (pd_ptr + 0x3FC0) s \<and> pd_ptr + 0x3FC0 \<notin> {ptr..ptr + 2 ^ bits - 1})\<rbrakk> \<Longrightarrow> False
 2. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); page_directory_at' pd_ptr (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); \<forall>y<0x1000. pde_at' (pd_ptr + (y << 2)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>pd_ptr x2a y asid a. \<lbrakk>pd_ptr + 0x3FC0 \<in> {ptr..+2 ^ bits}; is_aligned pd_ptr pdBits; pde_stored_asid x2a = Some y; armKSASIDMap (ksArchState s) a = Some (asid, pd_ptr); 0xFF0 < 0x1000 \<longrightarrow> pde_at' (pd_ptr + (0xFF0 << 2)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<rbrakk> \<Longrightarrow> pde_at' (pd_ptr + 0x3FC0) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>) proof (prove)
goal:
No subgoals! proof (state)
this:
set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
(s, s') \<in> rf_sr
kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {} proof (prove)
using this:
(s, s') \<in> rf_sr
kernel_data_refs \<inter> {ptr..ptr + 2 ^ bits - 1} = {}

goal (1 subgoal):
 1. ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {} proof (state)
this:
ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr
ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {} proof (prove)
using this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr
ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {}

goal (1 subgoal):
 1. hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr proof (prove)
using this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr
ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {}
is_aligned ptr bits
bits < word_bits

goal (1 subgoal):
 1. hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; ptr_span armKSGlobalPD_Ptr \<inter> {ptr..ptr + 2 ^ bits - 1} = {}; is_aligned ptr bits; bits < word_bits; t_hrs_' (globals s') = (a, b)\<rbrakk> \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr proof (prove)
goal:
No subgoals! proof (state)
this:
hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) proof (prove)
goal (2 subgoals):
 1. \<And>x y v. \<lbrakk>map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) proof (prove)
goal (2 subgoals):
 1. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
 2. \<And>x y v. \<lbrakk>map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x
 2. \<And>x y v. \<lbrakk>map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v. \<lbrakk>map_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2)\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (4 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> is_aligned x (?m44 x v)
 2. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> v < 2 ^ ?m44 x v
 3. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> ?m44 x v \<le> bits
 4. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; ptr \<le> x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr + 2 ^ bits - 1 < ?z61 x v
 2. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < ?z61 x v\<rbrakk> \<Longrightarrow> False
 3. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < x; x \<le> x + v\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserData; x2 = KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x; \<exists>cte. ctes_of s p = Some cte \<and> cteCap cte = capability.UntypedCap d ptr bits idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; valid_cap' (cteCap cte) s; ps_clear x (objBitsKO KOUserData) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x (objBitsKO KOUserData) s; is_aligned ptr bits; bits < word_bits; \<forall>p ko. ksPSpace s p = Some ko \<longrightarrow> obj_range' p ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' p ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' p ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x (objBitsKO KOUserData) s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<forall>ko. ksPSpace s x = Some ko \<longrightarrow> obj_range' x ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' x ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' x ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> ptr \<le> x + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr; ptr \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr; ptr \<le> ptr + 2 ^ bits - 1; True\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserData; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; cteCap cte = capability.UntypedCap d ptr bits idx; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> x \<le> x + 2 ^ pageBits
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); \<not> x \<le> x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + 2 ^ pageBits < x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + 2 ^ pageBits < x; x + 2 ^ pageBits < x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) proof (prove)
goal (2 subgoals):
 1. \<And>x y v. \<lbrakk>map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) proof (prove)
goal (2 subgoals):
 1. (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
 2. \<And>x y v. \<lbrakk>map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x. (if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 \<and> x \<in> dom (map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x)) then Some (\<lambda>y. word_rcat [0, 0, 0, 0]) else heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s)) x
 2. \<And>x y v. \<lbrakk>map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v. \<lbrakk>map_to_user_data_device (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) x = Some y; v < 2 ^ pageBits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2)\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1)
 2. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (4 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> is_aligned x (?m44 x v)
 2. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> v < 2 ^ ?m44 x v
 3. \<And>x v. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; pageBits \<le> bits\<rbrakk> \<Longrightarrow> ?m44 x v \<le> bits
 4. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits\<rbrakk> \<Longrightarrow> (ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1) = (ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1) proof (prove)
goal (1 subgoal):
 1. \<And>x y v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some x2; projectKO_opt x2 = Some y; is_aligned x (objBitsKO x2); \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; ptr \<le> x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> ptr + 2 ^ bits - 1 < ?z61 x v
 2. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < ?z61 x v\<rbrakk> \<Longrightarrow> False
 3. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v. \<lbrakk>v < 2 ^ pageBits; \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; \<not> pageBits \<le> bits; ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; x + v < x; x \<le> x + v\<rbrakk> \<Longrightarrow> False
 2. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v x2. \<lbrakk>v < 2 ^ pageBits; ptr \<le> x \<longrightarrow> \<not> x \<le> ptr + 2 ^ bits - 1; ksPSpace s x = Some KOUserDataDevice; x2 = KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; ptr \<le> x + v \<and> x + v \<le> ptr + 2 ^ bits - 1; \<not> ptr \<le> x; \<exists>cte. ctes_of s p = Some cte \<and> cteCap cte = capability.UntypedCap d ptr bits idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; valid_cap' (cteCap cte) s; ps_clear x (objBitsKO KOUserDataDevice) s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x (objBitsKO KOUserDataDevice) s; is_aligned ptr bits; bits < word_bits; \<forall>p ko. ksPSpace s p = Some ko \<longrightarrow> obj_range' p ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' p ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' p ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x (objBitsKO KOUserDataDevice) s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<forall>ko. ksPSpace s x = Some ko \<longrightarrow> obj_range' x ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' x ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' x ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; \<not> pageBits \<le> bits; \<not> ptr \<le> x; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; \<not> ptr \<le> x + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr; ptr \<le> ptr + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits - 1 < ptr; ptr \<le> ptr + 2 ^ bits - 1; True\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; ksPSpace s x = Some KOUserDataDevice; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; ctes_of s p = Some cte; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; cteCap cte = capability.UntypedCap d ptr bits idx; ps_clear x pageBits s; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; cteCap cte = capability.UntypedCap d ptr bits idx; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + 2 ^ bits - 1; is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> x \<le> x + 2 ^ pageBits
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); \<not> x \<le> x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + 2 ^ pageBits < x\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + 2 ^ pageBits < x; x + 2 ^ pageBits < x + (2 ^ pageBits - 1)\<rbrakk> \<Longrightarrow> False
 2. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>x v cte. \<lbrakk>v < 2 ^ pageBits; is_aligned x pageBits; bits < pageBits; x < ptr; ptr \<le> x + v; x + v \<le> ptr + (2 ^ bits - 1); is_aligned ptr bits; bits < word_bits; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; x + 2 ^ pageBits \<le> ptr; 0 < x + 2 ^ pageBits; x \<le> x + (2 ^ pageBits - 1); x + v < x + 2 ^ pageBits\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
valid_cap' (capability.UntypedCap d ptr bits idx) s
invs' s proof (prove)
using this:
valid_cap' (capability.UntypedCap d ptr bits idx) s
invs' s

goal (1 subgoal):
 1. \<And>p v. \<lbrakk>map_to_tcbs (ksPSpace s) p = Some v; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>map_to_tcbs (ksPSpace s) p = Some v; p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); valid_untyped' d ptr bits idx s; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); valid_untyped' d ptr bits idx s; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ko_at' v p s\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); \<forall>p ko. ksPSpace s p = Some ko \<longrightarrow> obj_range' p ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' p ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' p ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; obj_range' p ko \<inter> {ptr..ptr + 2 ^ bits - 1} \<noteq> {} \<longrightarrow> obj_range' p ko \<subseteq> {ptr..ptr + 2 ^ bits - 1} \<and> obj_range' p ko \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (2 subgoals):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}
 2. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> objBitsKO ko = objBitsT TCBT proof (prove)
goal (3 subgoals):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT; p \<in> {p..+2 ^ objBitsT TCBT}\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}
 2. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT\<rbrakk> \<Longrightarrow> p \<in> {p..+2 ^ objBitsT TCBT}
 3. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> objBitsKO ko = objBitsT TCBT proof (prove)
goal (3 subgoals):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsT TCBT); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsT TCBT) s; {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsT TCBT} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsT TCBT} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT; p \<in> {p..+2 ^ objBitsT TCBT}\<rbrakk> \<Longrightarrow> {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}
 2. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT\<rbrakk> \<Longrightarrow> p \<in> {p..+2 ^ objBitsT TCBT}
 3. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> objBitsKO ko = objBitsT TCBT proof (prove)
goal (2 subgoals):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}; objBitsKO ko = objBitsT TCBT\<rbrakk> \<Longrightarrow> p \<in> {p..+2 ^ objBitsT TCBT}
 2. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> objBitsKO ko = objBitsT TCBT proof (prove)
goal (1 subgoal):
 1. \<And>p v ko. \<lbrakk>p \<notin> {ptr..+2 ^ bits}; invs' s; capAligned (capability.UntypedCap d ptr bits idx); 0 < ptr; minUntypedSizeBits \<le> bits; bits \<le> maxUntypedSizeBits; idx \<le> 2 ^ bits; is_aligned (word_of_nat idx) minUntypedSizeBits; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); fst (projectKO ko s) = {(v, s)}; ps_clear p (objBitsKO ko) s; {p..+2 ^ objBitsKO ko} \<inter> {ptr..+2 ^ bits} \<noteq> {} \<longrightarrow> {p..+2 ^ objBitsKO ko} \<subseteq> {ptr..+2 ^ bits} \<and> {p..+2 ^ objBitsKO ko} \<inter> (if idx < 2 ^ bits then {ptr + word_of_nat idx..ptr + 2 ^ bits - 1} else {}) = {}\<rbrakk> \<Longrightarrow> objBitsKO ko = objBitsT TCBT proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>map_to_tcbs (ksPSpace s) ?p4 = Some ?v4; ?p4 \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {?p4..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
(ptr \<le> ?x \<and> ?x \<le> ptr + 2 ^ bits - 1) = (?x \<in> {ptr..+2 ^ bits})

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
\<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. x \<in> {ptr..+2 ^ bits}) proof (prove)
using this:
\<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. x \<in> {ptr..+2 ^ bits})

goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}; \<forall>p n. gsCNodes s p = Some n \<longrightarrow> is_aligned p (cte_level_bits + n) \<and> \<not> word_bits \<le> cte_level_bits + n \<and> ({p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {ptr..+2 ^ bits} \<or> {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {p. p \<notin> {ptr..+2 ^ bits}})\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}; is_aligned p (cte_level_bits + n) \<and> \<not> word_bits \<le> cte_level_bits + n \<and> ({p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {ptr..+2 ^ bits} \<or> {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {p. p \<notin> {ptr..+2 ^ bits}})\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}; is_aligned p (cte_level_bits + n); \<not> word_bits \<le> cte_level_bits + n; {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {ptr..+2 ^ bits} \<or> {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {p. p \<notin> {ptr..+2 ^ bits}}\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}; is_aligned p (cte_level_bits + n); \<not> word_bits \<le> cte_level_bits + n; {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {ptr..+2 ^ bits} \<or> {p..p + 2 ^ (cte_level_bits + n) - 1} \<subseteq> {p. p \<notin> {ptr..+2 ^ bits}}; p \<in> {p..p + (2 ^ (cte_level_bits + n) - 1)}\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p n. \<lbrakk>gsCNodes s p = Some n; p \<notin> {ptr..+2 ^ bits}; is_aligned p (n + cte_level_bits); \<not> word_bits \<le> n + cte_level_bits; {p..+2 ^ (n + cte_level_bits)} \<subseteq> {ptr..+2 ^ bits} \<or> {p..+2 ^ (n + cte_level_bits)} \<subseteq> {p. p \<notin> {ptr..+2 ^ bits}}; p \<in> {p..+2 ^ (n + cte_level_bits)}\<rbrakk> \<Longrightarrow> {p..+2 ^ (n + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>gsCNodes s ?p4 = Some ?n4; ?p4 \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {?p4..+2 ^ (?n4 + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {}

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
(s, s') \<in> rf_sr proof (prove)
using this:
(s, s') \<in> rf_sr

goal (1 subgoal):
 1. cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) &&& cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) proof (prove)
goal (2 subgoals):
 1. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s \<Longrightarrow> cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
 2. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s \<Longrightarrow> cvariable_array_map_relation (map_to_tcbs (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) proof (prove)
goal (2 subgoals):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; gsCNodes s p = Some v; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {p..+2 ^ v * 16} \<inter> {ptr..+2 ^ bits} = {}
 2. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s \<Longrightarrow> cvariable_array_map_relation (map_to_tcbs (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) proof (prove)
goal (2 subgoals):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; p \<notin> {ptr..+2 ^ bits}; {p..+2 ^ (v + cte_level_bits)} \<inter> {ptr..+2 ^ bits} = {}\<rbrakk> \<Longrightarrow> {p..+2 ^ v * 16} \<inter> {ptr..+2 ^ bits} = {}
 2. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s \<Longrightarrow> cvariable_array_map_relation (map_to_tcbs (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) proof (prove)
goal (1 subgoal):
 1. cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')) \<and> cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s) \<and> zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s) \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s) \<and> cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')) \<and> cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')) \<and> carch_state_relation (ksArchState s) (globals s') \<and> cmachine_state_relation (ksMachineState s) (globals s') \<and> cte_array_relation s (globals s') \<and> tcb_cte_array_relation s (globals s') \<and> apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s) \<and> ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s) \<and> ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs \<and> s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s) \<and> ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s) \<and> ksDomainTime_' (globals s') = ksDomainTime s \<Longrightarrow> cvariable_array_map_relation (map_to_tcbs (ksPSpace s)|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s')))) proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; map_to_tcbs (ksPSpace s) p = Some v; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {p..+80} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; p \<notin> {ptr..+2 ^ bits}; {p..+2 ^ objBitsT TCBT} \<inter> {ptr..+2 ^ bits} = {}\<rbrakk> \<Longrightarrow> {p..+80} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> {p..+80} \<subseteq> {p..+2 ^ objBitsT TCBT} proof (prove)
goal (1 subgoal):
 1. \<And>p v. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s; p \<notin> {ptr..+2 ^ bits}\<rbrakk> \<Longrightarrow> 80 \<le> 2 ^ objBitsT TCBT proof (prove)
goal:
No subgoals! proof (state)
this:
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
(s, s') \<in> rf_sr proof (prove)
using this:
(s, s') \<in> rf_sr

goal (1 subgoal):
 1. apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s) proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>(s, s') \<in> rf_sr; ghost'state_' (globals s') = (a, b, c)\<rbrakk> \<Longrightarrow> apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s) proof (prove)
goal:
No subgoals! proof (state)
this:
apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (state)
this:
apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s)

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
(s, s') \<in> rf_sr proof (prove)
using this:
(s, s') \<in> rf_sr

goal (1 subgoal):
 1. typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> {symbol_table ''intStateIRQNode''..+4096} \<inter> {ptr..+2 ^ bits} = {} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> {symbol_table ''intStateIRQNode''..+4096} \<inter> {ptr..ptr + 2 ^ bits - 1} = {} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpspace_relation (ksPSpace s) (underlying_memory (ksMachineState s)) (t_hrs_' (globals s')); cready_queues_relation (cslift s') (ksReadyQueues_' (globals s')) (ksReadyQueues s); zero_ranges_are_zero (gsUntypedZeroRanges s) (t_hrs_' (globals s')); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals s')) (ksReadyQueuesL1Bitmap s); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals s')) (ksReadyQueuesL2Bitmap s); ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s); ksIdleThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksIdleThread s); cinterrupt_relation (ksInterruptState s) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals s')); cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s')); carch_state_relation (ksArchState s) (globals s'); cmachine_state_relation (ksMachineState s) (globals s'); cte_array_relation s (globals s'); tcb_cte_array_relation s (globals s'); apsnd fst (ghost'state_' (globals s')) = (gsUserPages s, gsCNodes s); ghost_size_rel (ghost'state_' (globals s')) (gsMaxObjectSize s); ksWorkUnitsCompleted_' (globals s') = ksWorkUnitsCompleted s; s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule s) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals s') = word_of_nat (ksDomScheduleIdx s); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) (ksCurDomain s); ksDomainTime_' (globals s') = ksDomainTime s\<rbrakk> \<Longrightarrow> {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs proof (prove)
goal:
No subgoals! proof (state)
this:
typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr

goal (1 subgoal):
 1. \<And>s x. \<lbrakk>is_aligned ptr bits; 2 \<le> bits; bits < word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap d ptr bits idx) p s; descendants_range' (capability.UntypedCap d ptr bits idx) p (ctes_of s); invs' s; ct_active' s; sch_act_simple s; deletionIsSafe ptr bits s; \<not> cNodePartialOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1); ksASIDMapSafe (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>); (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (ksMachineState_update (underlying_memory_update (\<lambda>m x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else m x)) (s\<lparr>ksPSpace := \<lambda>a. if ptr \<le> a \<and> a \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s a\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) x) \<in> rf_sr proof (chain)
picking this:
cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr
heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s)
typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr proof (prove)
using this:
cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr
heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s)
typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr

goal (1 subgoal):
 1. (ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) s') \<in> rf_sr proof (prove)
using this:
cpspace_relation (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) (underlying_memory (ksMachineState s)) (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))
cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s')))) (ksReadyQueues_' (globals s')) (ksReadyQueues s)
asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) \<Longrightarrow> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift s' \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<circ>\<^sub>m pd_pointer_to_asid_slot)
s' \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<Longrightarrow> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr
heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_user_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else underlying_memory (ksMachineState s) x) = heap_to_device_data (\<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x) (underlying_memory (ksMachineState s))
cvariable_array_map_relation (gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) ((^) 2) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
cvariable_array_map_relation (map_to_tcbs (ksPSpace s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>)) (\<lambda>x. 5) cte_Ptr (typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))))
apsnd fst (gs_clear_region ptr bits (ghost'state_' (globals s'))) = (gsUserPages s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>, gsCNodes s|\<^bsub>(- {ptr..+2 ^ bits})\<^esub>) \<and> ghost_size_rel (gs_clear_region ptr bits (ghost'state_' (globals s'))) (gsMaxObjectSize s)
typ_region_bytes ptr bits (hrs_htd (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr
(s, s') \<in> rf_sr
{ptr..+2 ^ bits} \<subseteq> domain

goal (1 subgoal):
 1. (ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) s') \<in> rf_sr proof (state)
this:
(ksMachineState_update (underlying_memory_update (\<lambda>h x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then 0 else h x)) (s\<lparr>ksPSpace := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else ksPSpace s x\<rparr>)\<lparr>gsUserPages := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsUserPages s x, gsCNodes := \<lambda>x. if ptr \<le> x \<and> x \<le> ptr + 2 ^ bits - 1 then None else gsCNodes s x\<rparr>, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region ptr bits) (t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)) x)) s') \<in> rf_sr

goal:
No subgoals!