theory ADT_H

lemma absHeap_correct:
  assumes pspace_aligned:  "pspace_aligned s"
  assumes pspace_distinct: "pspace_distinct s"
  assumes valid_objs:      "valid_objs s"
  assumes pspace_relation: "pspace_relation (kheap s) (ksPSpace s')"
  assumes ghost_relation:  "ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')"
shows
  "absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s" proof - from ghost_relation have gsUserPages:
    "\<And>a sz. (\<exists>dev. kheap s a = Some (ArchObj (DataPage dev sz))) \<longleftrightarrow>
             gsUserPages s' a = Some sz"
   and gsCNodes:
    "\<And>a n. (\<exists>cs. kheap s a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) \<longleftrightarrow>
            gsCNodes s' a = Some n" by (fastforce simp add: ghost_relation_def)+ show "?thesis" supply  image_cong_simp [cong del] apply (rule ext) apply (simp add: absHeap_def split: option.splits) apply (rule conjI) using pspace_relation apply (clarsimp simp add: pspace_relation_def pspace_dom_def UNION_eq
                               dom_def Collect_eq) apply (erule_tac x=x in allE) apply clarsimp apply (case_tac "kheap s x", simp) apply (erule_tac x=x in allE, clarsimp) apply (erule_tac x=x in allE, simp add: Ball_def) apply (erule_tac x=x in allE, clarsimp) apply (case_tac a) apply (simp_all add: other_obj_relation_def
                       split: if_split_asm Structures_H.kernel_object.splits) apply (rename_tac sz cs) apply (clarsimp simp add: image_def cte_map_def
                 well_formed_cnode_n_def Collect_eq dom_def) apply (erule_tac x="replicate sz False" in allE)+ apply simp apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: image_def) apply (erule_tac x=0 in allE, simp) apply (erule_tac x=0 in allE, simp) apply clarsimp apply (erule_tac x=0 in allE, simp add: pageBits_def) apply (rename_tac vmpage_size) apply (case_tac vmpage_size, simp_all) apply clarsimp apply (intro conjI impI allI) apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply clarsimp apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (clarsimp simp add: ep_relation_def EndpointMap_def
                     split: Structures_A.endpoint.splits) apply (clarsimp simp add: EndpointMap_def
                    split: Structures_A.endpoint.splits) apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj,
                  simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm)+ apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (clarsimp simp add: ntfn_relation_def AEndpointMap_def
                    split: Structures_A.ntfn.splits) apply (clarsimp simp add: AEndpointMap_def
                   split: Structures_A.ntfn.splits) apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm)+ apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm)+ apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (rename_tac vmpage_size) apply (cut_tac a=y and sz=vmpage_size in gsUserPages, clarsimp split: if_split_asm) apply (case_tac "n=0", simp) apply (case_tac "kheap s (y + n * 2 ^ pageBits)") apply (rule ccontr) apply (clarsimp dest!: gsUserPages[symmetric, THEN iffD1] ) using pspace_aligned apply (simp add: pspace_aligned_def dom_def) apply (erule_tac x=y in allE) apply (case_tac "n=0",(simp split: if_split_asm)+) apply (frule (2) unaligned_page_offsets_helper) apply (frule_tac y="n*2^pageBits" in pspace_aligned_distinct_None'
                                          [OF pspace_aligned pspace_distinct]) apply simp apply (rule conjI, clarsimp simp add: word_gt_0) apply (simp add: is_aligned_mask) apply (clarsimp simp add: pageBits_def mask_def) apply (case_tac vmpage_size; simp) apply ((frule_tac i=n and k="0x1000" in word_mult_less_mono1, simp+)+)[4] apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (rename_tac vmpage_size) apply (cut_tac a=y and sz=vmpage_size in gsUserPages, clarsimp split: if_split_asm) apply (case_tac "n=0", simp) apply (case_tac "kheap s (y + n * 2 ^ pageBits)") apply (rule ccontr) apply (clarsimp dest!: gsUserPages[symmetric, THEN iffD1]) using pspace_aligned apply (simp add: pspace_aligned_def dom_def) apply (erule_tac x=y in allE) apply (case_tac "n=0",simp+) apply (frule (2) unaligned_page_offsets_helper) apply (frule_tac y="n*2^pageBits" in pspace_aligned_distinct_None'
                                          [OF pspace_aligned pspace_distinct]) apply simp apply (rule conjI, clarsimp simp add: word_gt_0) apply (simp add: is_aligned_mask) apply (clarsimp simp add: pageBits_def mask_def) apply (case_tac vmpage_size; simp) apply ((frule_tac i=n and k="0x1000" in word_mult_less_mono1, simp+)+)[4] apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) prefer 2 apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm) apply (clarsimp simp add: TcbMap_def tcb_relation_def valid_obj_def) apply (rename_tac tcb y tcb') apply (case_tac tcb) apply (case_tac tcb') apply (simp add: thread_state_relation_imp_ThStateMap) apply (subgoal_tac "map_option FaultMap (tcbFault tcb) = tcb_fault") prefer 2 apply (simp add: fault_rel_optionation_def) using valid_objs[simplified valid_objs_def dom_def fun_app_def,
                         simplified] apply (erule_tac x=y in allE) apply (clarsimp simp: valid_obj_def valid_tcb_def
                        split: option.splits) using valid_objs[simplified valid_objs_def Ball_def dom_def fun_app_def] apply (erule_tac x=y in allE) apply (clarsimp simp add: cap_relation_imp_CapabilityMap valid_obj_def
                                 valid_tcb_def ran_tcb_cap_cases valid_cap_def2
                                 arch_tcb_relation_imp_ArchTcnMap) apply (simp add: absCNode_def cte_map_def) apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def
                                 split: if_split_asm) prefer 2 apply (rename_tac arch_kernel_obj) apply (case_tac arch_kernel_obj, simp_all add: other_obj_relation_def) apply (clarsimp simp add: pte_relation_def) apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm) apply (simp add: cte_map_def) apply (clarsimp simp add: cte_relation_def) apply (cut_tac a=y and n=sz in gsCNodes, clarsimp) using pspace_aligned[simplified pspace_aligned_def] apply (drule_tac x=y in bspec, clarsimp) apply clarsimp apply (case_tac "(of_bl ya::word32) * 2^cte_level_bits = 0", simp) apply (rule ext) apply simp apply (rule conjI) prefer 2 using valid_objs[simplified valid_objs_def Ball_def dom_def
                                    fun_app_def] apply (erule_tac x=y in allE) apply (clarsimp simp add: valid_obj_def valid_cs_def valid_cs_size_def
                    well_formed_cnode_n_def dom_def Collect_eq) apply (frule_tac x=ya in spec, simp) apply (erule_tac x=bl in allE) apply clarsimp+ apply (frule pspace_relation_absD[OF _ pspace_relation]) apply (simp add: cte_map_def) apply (drule_tac x="y + of_bl bl * 2^cte_level_bits" in spec) apply clarsimp apply (erule_tac x="cte_relation bl" in allE) apply (erule impE) apply (fastforce simp add: well_formed_cnode_n_def) apply clarsimp apply (clarsimp simp add: cte_relation_def) apply (rule cap_relation_imp_CapabilityMap) using valid_objs[simplified valid_objs_def Ball_def dom_def
                                    fun_app_def] apply (erule_tac x=y in allE) apply (clarsimp simp: valid_obj_def valid_cs_def valid_cap_def2 ran_def) apply (fastforce simp: cte_level_bits_def cteSizeBits_def)+ apply (subgoal_tac "kheap s (y + of_bl ya * 2^cte_level_bits) = None") prefer 2 using valid_objs[simplified valid_objs_def Ball_def dom_def fun_app_def] apply (erule_tac x=y in allE) apply (clarsimp simp add: valid_obj_def valid_cs_def valid_cs_size_def) apply (rule pspace_aligned_distinct_None'[OF
                   pspace_aligned pspace_distinct], assumption) apply (clarsimp simp: word_neq_0_conv power_add cte_index_repair) apply (simp add: well_formed_cnode_n_def dom_def Collect_eq) apply (erule_tac x=ya in allE)+ apply (rule word_mult_less_mono1) apply (subgoal_tac "sz = length ya") apply simp apply (rule of_bl_length, (simp add: word_bits_def)+)[1] apply fastforce apply (simp add: cte_level_bits_def) apply (simp add: word_bits_conv cte_level_bits_def) apply (drule_tac a="2::nat" in power_strict_increasing, simp+) apply (rule ccontr, clarsimp) apply (cut_tac a="y + of_bl ya * 2^cte_level_bits" and n=yc in gsCNodes) apply clarsimp 

    (* mapping architecture-specific objects *)
     apply clarsimp apply (erule pspace_dom_relatedE[OF _ pspace_relation]) apply (case_tac ko, simp_all add: other_obj_relation_def) apply (clarsimp simp add: cte_relation_def split: if_split_asm) apply (rename_tac arch_kernel_object y ko P arch_kernel_obj) apply (case_tac arch_kernel_object, simp_all add: absHeapArch_def
                                            split: asidpool.splits) apply clarsimp apply (case_tac arch_kernel_obj) apply (simp add: other_obj_relation_def asid_pool_relation_def
                          inv_def o_def) apply (clarsimp simp add:  pte_relation_def) apply (clarsimp simp add:  pde_relation_def) apply (clarsimp split: if_split_asm)+ apply (case_tac arch_kernel_obj) apply (simp add: other_obj_relation_def asid_pool_relation_def inv_def
                         o_def) using pspace_aligned[simplified pspace_aligned_def Ball_def dom_def] apply (erule_tac x=y in allE) apply (clarsimp simp add: pte_relation_def absPageTable_def
                                 pt_bits_def pageBits_def) apply (rule conjI) prefer 2 apply clarsimp apply (rule sym) apply (rule pspace_aligned_distinct_None'
                    [OF pspace_aligned pspace_distinct], simp+) apply (cut_tac x=ya and n="2^10" in
               ucast_less_shiftl_helper[where 'a=32,simplified word_bits_conv], simp+) apply (clarsimp simp add: word_gt_0) apply clarsimp apply (subgoal_tac "ucast ya << 2 = 0") prefer 2 apply (rule ccontr) apply (frule_tac x=y in unaligned_helper, assumption) apply (rule ucast_less_shiftl_helper, simp_all) apply (rule ext) apply (frule pspace_relation_absD[OF _ pspace_relation]) apply simp apply (erule_tac x=offs in allE) apply (clarsimp simp add: pte_relation_def) using valid_objs[simplified valid_objs_def fun_app_def dom_def,
                        simplified] apply (erule_tac x=y in allE) apply (clarsimp simp add: valid_obj_def wellformed_pte_def) apply (erule_tac x=offs in allE) apply (rename_tac pte') apply (case_tac pte', simp_all add: pte_relation_aligned_def)[1] apply (clarsimp split: ARM_A.pte.splits) apply (rule set_eqI, clarsimp) apply (case_tac x, simp_all)[1] apply (clarsimp split: ARM_A.pte.splits) apply (rule set_eqI, clarsimp) apply (case_tac x, simp_all)[1] apply (clarsimp simp add: pde_relation_def) apply (clarsimp split: if_split_asm)+ apply (case_tac arch_kernel_obj) apply (simp add: other_obj_relation_def asid_pool_relation_def inv_def
                        o_def) apply (clarsimp simp add:  pte_relation_def) using pspace_aligned apply (simp add: pspace_aligned_def dom_def) apply (erule_tac x=y in allE) apply (clarsimp simp add: pde_relation_def absPageDirectory_def
                               pd_bits_def pageBits_def) apply (rule conjI) prefer 2 apply clarsimp apply (rule sym) apply (rule pspace_aligned_distinct_None'
                  [OF pspace_aligned pspace_distinct], simp+) apply (cut_tac x=ya and n="2^14" in
             ucast_less_shiftl_helper[where 'a=32, simplified word_bits_conv], simp+) apply (clarsimp simp add: word_gt_0) apply clarsimp apply (subgoal_tac "ucast ya << 2 = 0") prefer 2 apply (rule ccontr) apply (frule_tac x=y in unaligned_helper, assumption) apply (rule ucast_less_shiftl_helper, simp_all) apply (rule ext) apply (frule pspace_relation_absD[OF _ pspace_relation]) apply simp apply (erule_tac x=offs in allE) apply (clarsimp simp add: pde_relation_def) using valid_objs[simplified valid_objs_def fun_app_def dom_def,simplified] apply (erule_tac x=y in allE) apply (clarsimp simp add: valid_obj_def wellformed_pde_def) apply (erule_tac x=offs in allE) apply (rename_tac pde') apply (case_tac pde', simp_all add: pde_relation_aligned_def)[1] apply (clarsimp split: ARM_A.pde.splits)+ apply (fastforce simp add: subset_eq) apply (clarsimp split: ARM_A.pde.splits) apply (rule set_eqI, clarsimp) apply (case_tac x, simp_all)[1] apply (clarsimp split: ARM_A.pde.splits) apply (rule set_eqI, clarsimp) apply (case_tac x, simp_all)[1] apply (clarsimp simp add: pde_relation_def split: if_split_asm) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s proof (state)
goal (1 subgoal):
 1. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s proof (chain)
picking this:
ghost_relation (kheap s) (gsUserPages s') (gsCNodes s') proof (prove)
using this:
ghost_relation (kheap s) (gsUserPages s') (gsCNodes s')

goal (1 subgoal):
 1. (\<And>a sz. (\<exists>dev. kheap s a = Some (ArchObj (DataPage dev sz))) = (gsUserPages s' a = Some sz)) &&& (\<And>a n. (\<exists>cs. kheap s a = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (gsCNodes s' a = Some n)) proof (state)
this:
(\<exists>dev. kheap s ?a = Some (ArchObj (DataPage dev ?sz))) = (gsUserPages s' ?a = Some ?sz)
(\<exists>cs. kheap s ?a = Some (CNode ?n cs) \<and> well_formed_cnode_n ?n cs) = (gsCNodes s' ?a = Some ?n)

goal (1 subgoal):
 1. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s proof (prove)
goal (1 subgoal):
 1. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s proof (prove)
goal (1 subgoal):
 1. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s proof (prove)
goal (1 subgoal):
 1. \<And>x. absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') x = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x. (ksPSpace s' x = None \<longrightarrow> None = kheap s x) \<and> (\<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x. ksPSpace s' x = None \<longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
using this:
pspace_relation (kheap s) (ksPSpace s')

goal (2 subgoals):
 1. \<And>x. ksPSpace s' x = None \<longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>y. (\<exists>x. (\<exists>y. kheap s x = Some y) \<and> y \<in> fst ` obj_relation_cuts (the (kheap s x)) x) = (\<exists>ya. ksPSpace s' y = Some ya); \<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> (\<forall>xa\<in>obj_relation_cuts (the (kheap s x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap s x)) (the (ksPSpace s' y))); ksPSpace s' x = None\<rbrakk> \<Longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> (\<forall>xa\<in>obj_relation_cuts (the (kheap s x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap s x)) (the (ksPSpace s' y))); ksPSpace s' x = None; (\<exists>xa. (\<exists>y. kheap s xa = Some y) \<and> x \<in> fst ` obj_relation_cuts (the (kheap s xa)) xa) = (\<exists>y. ksPSpace s' x = Some y)\<rbrakk> \<Longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> (\<forall>xa\<in>obj_relation_cuts (the (kheap s x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap s x)) (the (ksPSpace s' y))); ksPSpace s' x = None; \<forall>xa. kheap s xa = None \<or> x \<notin> fst ` obj_relation_cuts (the (kheap s xa)) xa\<rbrakk> \<Longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x a. \<lbrakk>\<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> (\<forall>xa\<in>obj_relation_cuts (the (kheap s x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap s x)) (the (ksPSpace s' y))); ksPSpace s' x = None; \<forall>xa. kheap s xa = None \<or> x \<notin> fst ` obj_relation_cuts (the (kheap s xa)) xa; kheap s x = Some a\<rbrakk> \<Longrightarrow> None = kheap s x
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x a. \<lbrakk>ksPSpace s' x = None; \<forall>xa. kheap s xa = None \<or> x \<notin> fst ` obj_relation_cuts (the (kheap s xa)) xa; kheap s x = Some a; \<forall>x\<in>obj_relation_cuts a x. case x of (y, P) \<Rightarrow> P a (the (ksPSpace s' y))\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x a. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; \<forall>aa b. (aa, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the (ksPSpace s' aa)); x \<notin> fst ` obj_relation_cuts a x\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x a. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x a x11 x12. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None); a = CNode x11 x12\<rbrakk> \<Longrightarrow> False
 2. \<And>x a x2. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None); a = TCB x2\<rbrakk> \<Longrightarrow> False
 3. \<And>x a x3. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None); a = Endpoint x3\<rbrakk> \<Longrightarrow> False
 4. \<And>x a x4. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None); a = Notification x4\<rbrakk> \<Longrightarrow> False
 5. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some a; x \<notin> fst ` obj_relation_cuts a x; \<forall>b. (x, b) \<in> obj_relation_cuts a x \<longrightarrow> b a (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<forall>x2. ksPSpace s' x = Some x2 \<longrightarrow> (case x2 of KOEndpoint ep \<Rightarrow> Some (Endpoint (EndpointMap ep)) | KONotification ntfn \<Rightarrow> Some (Notification (AEndpointMap ntfn)) | KOUserData \<Rightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) | KOUserDataDevice \<Rightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) | KOTCB tcb \<Rightarrow> Some (TCB (TcbMap tcb)) | KOCTE cte \<Rightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) | KOArch ako \<Rightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x ako)) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x a x11 x12. \<lbrakk>\<forall>b. (\<exists>y. x = cte_map (x, y) \<and> b = cte_relation y \<and> y \<in> dom x12) \<longrightarrow> b (CNode x11 x12) (the None); a = CNode x11 x12; ksPSpace s' x = None; kheap s x = Some (CNode x11 x12); well_formed_cnode_n x11 x12; x \<notin> fst ` {(cte_map (x, y), cte_relation y) |y. y \<in> dom x12}\<rbrakk> \<Longrightarrow> False
 2. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj x5); x \<notin> fst ` aobj_relation_cuts x5 x; \<forall>b. (x, b) \<in> aobj_relation_cuts x5 x \<longrightarrow> b (ArchObj x5) (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x a sz cs. \<lbrakk>\<forall>b. (\<exists>y. x = cte_map (x, y) \<and> b = cte_relation y \<and> y \<in> dom cs) \<longrightarrow> b (CNode sz cs) (the None); a = CNode sz cs; ksPSpace s' x = None; kheap s x = Some (CNode sz cs); well_formed_cnode_n sz cs; x \<notin> fst ` {(cte_map (x, y), cte_relation y) |y. y \<in> dom cs}\<rbrakk> \<Longrightarrow> False
 2. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj x5); x \<notin> fst ` aobj_relation_cuts x5 x; \<forall>b. (x, b) \<in> aobj_relation_cuts x5 x \<longrightarrow> b (ArchObj x5) (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x sz cs. \<lbrakk>\<forall>b. (\<exists>y. of_bl y * 2 ^ cte_level_bits = 0 \<and> b = cte_relation y \<and> length y = sz) \<longrightarrow> b (CNode sz cs) (the None); ksPSpace s' x = None; kheap s x = Some (CNode sz cs); \<forall>a. (\<exists>y. cs a = Some y) = (length a = sz); \<forall>y. of_bl y * 2 ^ cte_level_bits = 0 \<longrightarrow> length y \<noteq> sz\<rbrakk> \<Longrightarrow> False
 2. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj x5); x \<notin> fst ` aobj_relation_cuts x5 x; \<forall>b. (x, b) \<in> aobj_relation_cuts x5 x \<longrightarrow> b (ArchObj x5) (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x sz cs. \<lbrakk>\<forall>b. (\<exists>y. of_bl y * 2 ^ cte_level_bits = 0 \<and> b = cte_relation y \<and> length y = sz) \<longrightarrow> b (CNode sz cs) (the None); ksPSpace s' x = None; kheap s x = Some (CNode sz cs); (\<exists>y. cs (replicate sz False) = Some y) = (length (replicate sz False) = sz); of_bl (replicate sz False) * 2 ^ cte_level_bits = 0 \<longrightarrow> length (replicate sz False) \<noteq> sz\<rbrakk> \<Longrightarrow> False
 2. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj x5); x \<notin> fst ` aobj_relation_cuts x5 x; \<forall>b. (x, b) \<in> aobj_relation_cuts x5 x \<longrightarrow> b (ArchObj x5) (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x a x5. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj x5); x \<notin> fst ` aobj_relation_cuts x5 x; \<forall>b. (x, b) \<in> aobj_relation_cuts x5 x \<longrightarrow> b (ArchObj x5) (the None); a = ArchObj x5\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x a arch_kernel_obj. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj arch_kernel_obj); x \<notin> fst ` aobj_relation_cuts arch_kernel_obj x; \<forall>b. (x, b) \<in> aobj_relation_cuts arch_kernel_obj x \<longrightarrow> b (ArchObj arch_kernel_obj) (the None); a = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>x a arch_kernel_obj x2. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (PageTable x2)); \<forall>x. UCAST(8 \<rightarrow> 32) x << 2 \<noteq> 0; a = ArchObj (PageTable x2); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> False
 2. \<And>x a arch_kernel_obj x3. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (PageDirectory x3)); \<forall>x. UCAST(12 \<rightarrow> 32) x << 2 \<noteq> 0; a = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> False
 3. \<And>x a arch_kernel_obj x41 x42. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 x42)); \<forall>n. n * 2 ^ pageBits = 0 \<longrightarrow> \<not> n < 2 ^ (pageBitsForSize x42 - pageBits); \<forall>b. (\<exists>n. n * 2 ^ pageBits = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits)) \<longrightarrow> b (ArchObj (DataPage x41 x42)) (the None); a = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x a arch_kernel_obj x3. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (PageDirectory x3)); \<forall>x. UCAST(12 \<rightarrow> 32) x << 2 \<noteq> 0; a = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> False
 2. \<And>x a arch_kernel_obj x41 x42. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 x42)); \<forall>n. n * 2 ^ pageBits = 0 \<longrightarrow> \<not> n < 2 ^ (pageBitsForSize x42 - pageBits); \<forall>b. (\<exists>n. n * 2 ^ pageBits = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits)) \<longrightarrow> b (ArchObj (DataPage x41 x42)) (the None); a = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x a arch_kernel_obj x41 x42. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 x42)); \<forall>n. n * 2 ^ pageBits = 0 \<longrightarrow> \<not> n < 2 ^ (pageBitsForSize x42 - pageBits); \<forall>b. (\<exists>n. n * 2 ^ pageBits = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits)) \<longrightarrow> b (ArchObj (DataPage x41 x42)) (the None); a = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x x41 x42. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 x42)); \<forall>n. n * 2 ^ pageBits = 0 \<longrightarrow> \<not> n < 2 ^ (pageBitsForSize x42 - pageBits); \<forall>b. (\<exists>n. n * 2 ^ pageBits = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits)) \<longrightarrow> b (ArchObj (DataPage x41 x42)) (the None)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x x41 x42. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 x42)); \<forall>b. (\<exists>n. n * 0x1000 = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - 12)) \<longrightarrow> b (ArchObj (DataPage x41 x42)) (the None); \<not> 0 < 2 ^ (pageBitsForSize x42 - 12)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x x41 vmpage_size. \<lbrakk>ksPSpace s' x = None; kheap s x = Some (ArchObj (DataPage x41 vmpage_size)); \<forall>b. (\<exists>n. n * 0x1000 = 0 \<and> b = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize vmpage_size - 12)) \<longrightarrow> b (ArchObj (DataPage x41 vmpage_size)) (the None); \<not> 0 < 2 ^ (pageBitsForSize vmpage_size - 12)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (1 subgoal):
 1. \<And>x. \<forall>x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (1 subgoal):
 1. \<And>x x2. (\<forall>x1. x2 = KOEndpoint x1 \<longrightarrow> ksPSpace s' x = Some (KOEndpoint x1) \<longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x) \<and> (\<forall>x2a. x2 = KONotification x2a \<longrightarrow> ksPSpace s' x = Some (KONotification x2a) \<longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x) \<and> (x2 = KOKernelData \<longrightarrow> ksPSpace s' x = Some KOKernelData \<longrightarrow> undefined = kheap s x) \<and> (x2 = KOUserData \<longrightarrow> ksPSpace s' x = Some KOUserData \<longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x) \<and> (x2 = KOUserDataDevice \<longrightarrow> ksPSpace s' x = Some KOUserDataDevice \<longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x) \<and> (\<forall>x6. x2 = KOTCB x6 \<longrightarrow> ksPSpace s' x = Some (KOTCB x6) \<longrightarrow> Some (TCB (TcbMap x6)) = kheap s x) \<and> (\<forall>x7. x2 = KOCTE x7 \<longrightarrow> ksPSpace s' x = Some (KOCTE x7) \<longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x) \<and> (\<forall>x8. x2 = KOArch x8 \<longrightarrow> ksPSpace s' x = Some (KOArch x8) \<longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x) proof (prove)
goal (8 subgoals):
 1. \<And>x x2 x1. \<lbrakk>x2 = KOEndpoint x1; ksPSpace s' x = Some (KOEndpoint x1)\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x x2. \<lbrakk>x2 = KOKernelData; ksPSpace s' x = Some KOKernelData\<rbrakk> \<Longrightarrow> undefined = kheap s x
 4. \<And>x x2. \<lbrakk>x2 = KOUserData; ksPSpace s' x = Some KOUserData\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x x2. \<lbrakk>x2 = KOUserDataDevice; ksPSpace s' x = Some KOUserDataDevice\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x2 x1 y ko P. \<lbrakk>x2 = KOEndpoint x1; kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KOEndpoint x1)\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x x2. \<lbrakk>x2 = KOKernelData; ksPSpace s' x = Some KOKernelData\<rbrakk> \<Longrightarrow> undefined = kheap s x
 4. \<And>x x2. \<lbrakk>x2 = KOUserData; ksPSpace s' x = Some KOUserData\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x x2. \<lbrakk>x2 = KOUserDataDevice; ksPSpace s' x = Some KOUserDataDevice\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x1 y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KOEndpoint x1)\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x x2. \<lbrakk>x2 = KOKernelData; ksPSpace s' x = Some KOKernelData\<rbrakk> \<Longrightarrow> undefined = kheap s x
 4. \<And>x x2. \<lbrakk>x2 = KOUserData; ksPSpace s' x = Some KOUserData\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x x2. \<lbrakk>x2 = KOUserDataDevice; ksPSpace s' x = Some KOUserDataDevice\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (10 subgoals):
 1. \<And>x x1 y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) (KOEndpoint x1); ko = CNode x11 x12\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 2. \<And>x x1 y ko x3. \<lbrakk>kheap s y = Some (Endpoint x3); x = y; ep_relation x3 x1; ko = Endpoint x3\<rbrakk> \<Longrightarrow> EndpointMap x1 = x3
 3. \<And>x x1 y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOEndpoint x1); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 4. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 7. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 8. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 9. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 10. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (9 subgoals):
 1. \<And>x x1 y ko x3. \<lbrakk>kheap s y = Some (Endpoint x3); x = y; ep_relation x3 x1; ko = Endpoint x3\<rbrakk> \<Longrightarrow> EndpointMap x1 = x3
 2. \<And>x x1 y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOEndpoint x1); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 3. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 7. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 8. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 9. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x1 y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOEndpoint x1); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Endpoint (EndpointMap x1)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x1 y P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOEndpoint x1)\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x1 y P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOEndpoint x1)\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (10 subgoals):
 1. \<And>x x1 y P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj (PageTable x2)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2)) (KOEndpoint x1); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 2. \<And>x x1 y P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOEndpoint x1); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 3. \<And>x x1 y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOEndpoint x1); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 4. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 7. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 8. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 9. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 10. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (9 subgoals):
 1. \<And>x x1 y P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOEndpoint x1); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 2. \<And>x x1 y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOEndpoint x1); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 3. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 7. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 8. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 9. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x1 y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOEndpoint x1); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (Endpoint (case x1 of Structures_H.endpoint.RecvEP x \<Rightarrow> Structures_A.endpoint.RecvEP x | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_A.endpoint.IdleEP | Structures_H.endpoint.SendEP x \<Rightarrow> Structures_A.endpoint.SendEP x)) = kheap s x
 2. \<And>x x2 x2a. \<lbrakk>x2 = KONotification x2a; ksPSpace s' x = Some (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a. ksPSpace s' x = Some (KONotification x2a) \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KONotification x2a)\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (9 subgoals):
 1. \<And>x x2a y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) (KONotification x2a); ko = CNode x11 x12\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 2. \<And>x x2a y ko x4. \<lbrakk>kheap s y = Some (Notification x4); x = y; ntfn_relation x4 x2a; ko = Notification x4\<rbrakk> \<Longrightarrow> AEndpointMap x2a = x4
 3. \<And>x x2a y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KONotification x2a); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 7. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 8. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 9. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x2a y ko x4. \<lbrakk>kheap s y = Some (Notification x4); x = y; ntfn_relation x4 x2a; ko = Notification x4\<rbrakk> \<Longrightarrow> AEndpointMap x2a = x4
 2. \<And>x x2a y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KONotification x2a); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KONotification x2a); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (Notification (AEndpointMap x2a)) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a y P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KONotification x2a)\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a y P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KONotification x2a)\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (9 subgoals):
 1. \<And>x x2a y P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj (PageTable x2)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2)) (KONotification x2a); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 2. \<And>x x2a y P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KONotification x2a); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 3. \<And>x x2a y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KONotification x2a); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 4. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 6. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 7. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 8. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 9. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x x2a y P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KONotification x2a); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 2. \<And>x x2a y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KONotification x2a); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 3. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x x2a y P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KONotification x2a); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (ntfnObj x2a = Structures_H.ntfn.IdleNtfn \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.IdleNtfn, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x2. ntfnObj x2a = Structures_H.ntfn.ActiveNtfn x2 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.ActiveNtfn x2, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x) \<and> (\<forall>x3. ntfnObj x2a = Structures_H.ntfn.WaitingNtfn x3 \<longrightarrow> Some (Notification \<lparr>ntfn_obj = Structures_A.ntfn.WaitingNtfn x3, ntfn_bound_tcb = ntfnBoundTCB x2a\<rparr>) = kheap s x)
 2. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x. ksPSpace s' x = Some KOKernelData \<Longrightarrow> undefined = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko KOKernelData\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) KOKernelData; ko = CNode x11 x12\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOKernelData; ko = ArchObj x5\<rbrakk> \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOKernelData; ko = ArchObj x5\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) KOKernelData; ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>x y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj (PageTable x2)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2)) KOKernelData; ko = ArchObj (PageTable x2); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOKernelData; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> undefined = kheap s x
 3. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOKernelData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> undefined = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOKernelData; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOKernelData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> undefined = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOKernelData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> undefined = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x. ksPSpace s' x = Some KOUserData \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko KOUserData\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) KOUserData; ko = CNode x11 x12\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOUserData; ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOUserData; ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) KOUserData; ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>x y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj (PageTable x2)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2)) KOUserData; ko = ArchObj (PageTable x2); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOUserData; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 4. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOUserData; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserData; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P arch_kernel_obj x41 vmpage_size. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 vmpage_size)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize vmpage_size - pageBits); P (ArchObj (DataPage x41 vmpage_size)) KOUserData; ko = ArchObj (DataPage x41 vmpage_size); arch_kernel_obj = DataPage x41 vmpage_size\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' x) = kheap s x
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits)\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = None; map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) \<noteq> kheap s (y + n * 2 ^ pageBits)\<rbrakk> \<Longrightarrow> False
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
pspace_aligned s

goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage False) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a; \<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> is_aligned x (obj_bits (the (kheap s x)))\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> is_aligned y (obj_bits (the (kheap s y)))\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 2. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits \<in> {0<..<2 ^ obj_bits (ArchObj (DataPage False vmpage_size))}
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> 0 < n * 2 ^ pageBits \<and> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; y && mask (pageBitsForSize vmpage_size) = 0; n \<noteq> 0; y + n * 2 ^ pageBits && mask (pageBitsForSize vmpage_size) \<noteq> 0\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - 12); kheap s (y + n * 0x1000) = Some a; y && 2 ^ pageBitsForSize vmpage_size - 1 = 0; n \<noteq> 0; y + n * 0x1000 && 2 ^ pageBitsForSize vmpage_size - 1 \<noteq> 0\<rbrakk> \<Longrightarrow> n * 0x1000 < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 3. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (8 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMLargePage; kheap s y = Some (ArchObj (DataPage False ARMLargePage)); \<not> x41; n < 0x10; kheap s (y + n * 0x1000) = Some a; y && 0xFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFF \<noteq> 0; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x10000
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMSection; kheap s y = Some (ArchObj (DataPage False ARMSection)); \<not> x41; n < 0x100; kheap s (y + n * 0x1000) = Some a; y && 0xFFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFFF \<noteq> 0; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x100000
 3. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMSuperSection; kheap s y = Some (ArchObj (DataPage False ARMSuperSection)); \<not> x41; n < 0x1000; kheap s (y + n * 0x1000) = Some a; y && 0xFFFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFFFF \<noteq> 0; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x1000000
 4. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage False vmpage_size)); \<not> x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage False z) = a
 5. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 6. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 7. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 8. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x. ksPSpace s' x = Some KOUserDataDevice \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko KOUserDataDevice\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) KOUserDataDevice; ko = CNode x11 x12\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOUserDataDevice; ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) KOUserDataDevice; ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x y ko P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) KOUserDataDevice; ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj (PageTable x2)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2)) KOUserDataDevice; ko = ArchObj (PageTable x2); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOUserDataDevice; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserDataDevice; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 4. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) KOUserDataDevice; ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserDataDevice; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x y ko P arch_kernel_obj x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) KOUserDataDevice; ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x y ko P arch_kernel_obj x41 vmpage_size. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 vmpage_size)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize vmpage_size - pageBits); P (ArchObj (DataPage x41 vmpage_size)) KOUserDataDevice; ko = ArchObj (DataPage x41 vmpage_size); arch_kernel_obj = DataPage x41 vmpage_size\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' x) = kheap s x
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits)\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = None; map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) \<noteq> kheap s (y + n * 2 ^ pageBits)\<rbrakk> \<Longrightarrow> False
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
pspace_aligned s

goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a\<rbrakk> \<Longrightarrow> map_option (ArchObj \<circ> DataPage True) (gsUserPages s' (y + n * 2 ^ pageBits)) = kheap s (y + n * 2 ^ pageBits)
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a; \<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> is_aligned x (obj_bits (the (kheap s x)))\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); n \<noteq> 0; kheap s (y + n * 2 ^ pageBits) = Some a; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> is_aligned y (obj_bits (the (kheap s y)))\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 2. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits \<in> {0<..<2 ^ obj_bits (ArchObj (DataPage True vmpage_size))}
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> 0 < n * 2 ^ pageBits \<and> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; y && mask (pageBitsForSize vmpage_size) = 0; n \<noteq> 0; y + n * 2 ^ pageBits && mask (pageBitsForSize vmpage_size) \<noteq> 0\<rbrakk> \<Longrightarrow> n * 2 ^ pageBits < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - 12); kheap s (y + n * 0x1000) = Some a; y && 2 ^ pageBitsForSize vmpage_size - 1 = 0; n \<noteq> 0; y + n * 0x1000 && 2 ^ pageBitsForSize vmpage_size - 1 \<noteq> 0\<rbrakk> \<Longrightarrow> n * 0x1000 < 2 ^ pageBitsForSize vmpage_size
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 3. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (7 subgoals):
 1. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMLargePage; kheap s y = Some (ArchObj (DataPage True ARMLargePage)); x41; n < 0x10; kheap s (y + n * 0x1000) = Some a; y && 0xFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFF \<noteq> 0; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x10000
 2. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMSection; kheap s y = Some (ArchObj (DataPage True ARMSection)); x41; n < 0x100; kheap s (y + n * 0x1000) = Some a; y && 0xFFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFFF \<noteq> 0; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x100000
 3. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some ARMSuperSection; kheap s y = Some (ArchObj (DataPage True ARMSuperSection)); x41; n < 0x1000; kheap s (y + n * 0x1000) = Some a; y && 0xFFFFFF = 0; n \<noteq> 0; y + n * 0x1000 && 0xFFFFFF \<noteq> 0; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> n * 0x1000 < 0x1000000
 4. \<And>y x41 vmpage_size n a. \<lbrakk>gsUserPages s' y = Some vmpage_size; kheap s y = Some (ArchObj (DataPage True vmpage_size)); x41; n < 2 ^ (pageBitsForSize vmpage_size - pageBits); kheap s (y + n * 2 ^ pageBits) = Some a; is_aligned y (pageBitsForSize vmpage_size); n \<noteq> 0; \<not> is_aligned (y + n * 2 ^ pageBits) (pageBitsForSize vmpage_size); kheap s (y + n * 2 ^ pageBits) = None\<rbrakk> \<Longrightarrow> \<exists>z. gsUserPages s' (y + n * 2 ^ pageBits) = Some z \<and> ArchObj (DataPage True z) = a
 5. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 6. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 7. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x6. \<lbrakk>x2 = KOTCB x6; ksPSpace s' x = Some (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x6 y ko P. \<lbrakk>x2 = KOTCB x6; kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KOTCB x6)\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x x2 x6 y ko P x11 x12. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) (KOTCB x6); ko = CNode x11 x12\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 3. \<And>x x2 x6 y ko P x5. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOTCB x6); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 2. \<And>x x2 x6 y ko P x5. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOTCB x6); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x x2 x6 y ko P x5. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOTCB x6); ko = ArchObj x5\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x x2 x6 y ko P arch_kernel_obj. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOTCB x6); ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>x x2 x6 y ko P arch_kernel_obj x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (PageTable x2a)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2a)) (KOTCB x6); ko = ArchObj (PageTable x2a); arch_kernel_obj = PageTable x2a\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko P arch_kernel_obj x3. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOTCB x6); ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x6 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOTCB x6); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 4. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 5. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x x2 x6 y ko P arch_kernel_obj x3. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOTCB x6); ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOTCB x6); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 3. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 4. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x x2 x6 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOTCB x6); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (TCB (TcbMap x6)) = kheap s x
 2. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x6 y ko x2a. \<lbrakk>x2 = KOTCB x6; kheap s y = Some (TCB x2a); x = y; tcb_relation x2a x6; ko = TCB x2a\<rbrakk> \<Longrightarrow> TcbMap x6 = x2a
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x6 y x2a. \<lbrakk>kheap s y = Some (TCB x2a); tcb_fault_handler x2a = to_bl (tcbFaultHandler x6); tcb_ipc_buffer x2a = tcbIPCBuffer x6; arch_tcb_relation (tcb_arch x2a) (tcbArch x6); thread_state_relation (tcb_state x2a) (tcbState x6); fault_rel_optionation (tcb_fault x2a) (tcbFault x6); cap_relation (tcb_ctable x2a) (cteCap (tcbCTable x6)); cap_relation (tcb_vtable x2a) (cteCap (tcbVTable x6)); cap_relation (tcb_reply x2a) (cteCap (tcbReply x6)); cap_relation (tcb_caller x2a) (cteCap (tcbCaller x6)); cap_relation (tcb_ipcframe x2a) (cteCap (tcbIPCBufferFrame x6)); tcb_bound_notification x2a = tcbBoundNotification x6; tcb_mcpriority x2a = tcbMCP x6\<rbrakk> \<Longrightarrow> \<lparr>tcb_ctable = CapabilityMap (cteCap (tcbCTable x6)), tcb_vtable = CapabilityMap (cteCap (tcbVTable x6)), tcb_reply = CapabilityMap (cteCap (tcbReply x6)), tcb_caller = CapabilityMap (cteCap (tcbCaller x6)), tcb_ipcframe = CapabilityMap (cteCap (tcbIPCBufferFrame x6)), tcb_state = ThStateMap (tcbState x6), tcb_fault_handler = to_bl (tcbFaultHandler x6), tcb_ipc_buffer = tcbIPCBuffer x6, tcb_fault = map_option FaultMap (tcbFault x6), tcb_bound_notification = tcbBoundNotification x6, tcb_mcpriority = tcbMCP x6, tcb_arch = ArchTcbMap (tcbArch x6)\<rparr> = x2a
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb'. \<lbrakk>kheap s y = Some (TCB tcb'); tcb_fault_handler tcb' = to_bl (tcbFaultHandler tcb); tcb_ipc_buffer tcb' = tcbIPCBuffer tcb; arch_tcb_relation (tcb_arch tcb') (tcbArch tcb); thread_state_relation (tcb_state tcb') (tcbState tcb); fault_rel_optionation (tcb_fault tcb') (tcbFault tcb); cap_relation (tcb_ctable tcb') (cteCap (tcbCTable tcb)); cap_relation (tcb_vtable tcb') (cteCap (tcbVTable tcb)); cap_relation (tcb_reply tcb') (cteCap (tcbReply tcb)); cap_relation (tcb_caller tcb') (cteCap (tcbCaller tcb)); cap_relation (tcb_ipcframe tcb') (cteCap (tcbIPCBufferFrame tcb)); tcb_bound_notification tcb' = tcbBoundNotification tcb; tcb_mcpriority tcb' = tcbMCP tcb\<rbrakk> \<Longrightarrow> \<lparr>tcb_ctable = CapabilityMap (cteCap (tcbCTable tcb)), tcb_vtable = CapabilityMap (cteCap (tcbVTable tcb)), tcb_reply = CapabilityMap (cteCap (tcbReply tcb)), tcb_caller = CapabilityMap (cteCap (tcbCaller tcb)), tcb_ipcframe = CapabilityMap (cteCap (tcbIPCBufferFrame tcb)), tcb_state = ThStateMap (tcbState tcb), tcb_fault_handler = to_bl (tcbFaultHandler tcb), tcb_ipc_buffer = tcbIPCBuffer tcb, tcb_fault = map_option FaultMap (tcbFault tcb), tcb_bound_notification = tcbBoundNotification tcb, tcb_mcpriority = tcbMCP tcb, tcb_arch = ArchTcbMap (tcbArch tcb)\<rparr> = tcb'
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16. \<lbrakk>kheap s y = Some (TCB tcb'); tcb_fault_handler tcb' = to_bl (tcbFaultHandler tcb); tcb_ipc_buffer tcb' = tcbIPCBuffer tcb; arch_tcb_relation (tcb_arch tcb') (tcbArch tcb); thread_state_relation (tcb_state tcb') (tcbState tcb); fault_rel_optionation (tcb_fault tcb') (tcbFault tcb); cap_relation (tcb_ctable tcb') (cteCap (tcbCTable tcb)); cap_relation (tcb_vtable tcb') (cteCap (tcbVTable tcb)); cap_relation (tcb_reply tcb') (cteCap (tcbReply tcb)); cap_relation (tcb_caller tcb') (cteCap (tcbCaller tcb)); cap_relation (tcb_ipcframe tcb') (cteCap (tcbIPCBufferFrame tcb)); tcb_bound_notification tcb' = tcbBoundNotification tcb; tcb_mcpriority tcb' = tcbMCP tcb; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16\<rbrakk> \<Longrightarrow> \<lparr>tcb_ctable = CapabilityMap (cteCap (tcbCTable tcb)), tcb_vtable = CapabilityMap (cteCap (tcbVTable tcb)), tcb_reply = CapabilityMap (cteCap (tcbReply tcb)), tcb_caller = CapabilityMap (cteCap (tcbCaller tcb)), tcb_ipcframe = CapabilityMap (cteCap (tcbIPCBufferFrame tcb)), tcb_state = ThStateMap (tcbState tcb), tcb_fault_handler = to_bl (tcbFaultHandler tcb), tcb_ipc_buffer = tcbIPCBuffer tcb, tcb_fault = map_option FaultMap (tcbFault tcb), tcb_bound_notification = tcbBoundNotification tcb, tcb_mcpriority = tcbMCP tcb, tcb_arch = ArchTcbMap (tcbArch tcb)\<rparr> = tcb'
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctablea tcb_vtablea tcb_replya tcb_callera tcb_ipcframea tcb_statea tcb_fault_handlera tcb_ipc_buffera tcb_faulta tcb_bound_notificationa tcb_mcprioritya tcb_archa. \<lbrakk>kheap s y = Some (TCB tcb'); tcb_fault_handler tcb' = to_bl (tcbFaultHandler tcb); tcb_ipc_buffer tcb' = tcbIPCBuffer tcb; arch_tcb_relation (tcb_arch tcb') (tcbArch tcb); thread_state_relation (tcb_state tcb') (tcbState tcb); fault_rel_optionation (tcb_fault tcb') (tcbFault tcb); cap_relation (tcb_ctable tcb') (cteCap (tcbCTable tcb)); cap_relation (tcb_vtable tcb') (cteCap (tcbVTable tcb)); cap_relation (tcb_reply tcb') (cteCap (tcbReply tcb)); cap_relation (tcb_caller tcb') (cteCap (tcbCaller tcb)); cap_relation (tcb_ipcframe tcb') (cteCap (tcbIPCBufferFrame tcb)); tcb_bound_notification tcb' = tcbBoundNotification tcb; tcb_mcpriority tcb' = tcbMCP tcb; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctablea, tcb_vtable = tcb_vtablea, tcb_reply = tcb_replya, tcb_caller = tcb_callera, tcb_ipcframe = tcb_ipcframea, tcb_state = tcb_statea, tcb_fault_handler = tcb_fault_handlera, tcb_ipc_buffer = tcb_ipc_buffera, tcb_fault = tcb_faulta, tcb_bound_notification = tcb_bound_notificationa, tcb_mcpriority = tcb_mcprioritya, tcb_arch = tcb_archa\<rparr>\<rbrakk> \<Longrightarrow> \<lparr>tcb_ctable = CapabilityMap (cteCap (tcbCTable tcb)), tcb_vtable = CapabilityMap (cteCap (tcbVTable tcb)), tcb_reply = CapabilityMap (cteCap (tcbReply tcb)), tcb_caller = CapabilityMap (cteCap (tcbCaller tcb)), tcb_ipcframe = CapabilityMap (cteCap (tcbIPCBufferFrame tcb)), tcb_state = ThStateMap (tcbState tcb), tcb_fault_handler = to_bl (tcbFaultHandler tcb), tcb_ipc_buffer = tcbIPCBuffer tcb, tcb_fault = map_option FaultMap (tcbFault tcb), tcb_bound_notification = tcbBoundNotification tcb, tcb_mcpriority = tcbMCP tcb, tcb_arch = ArchTcbMap (tcbArch tcb)\<rparr> = tcb'
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 2. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>\<rbrakk> \<Longrightarrow> map_option FaultMap (tcbFault tcb) = tcb_fault
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>\<rbrakk> \<Longrightarrow> map_option FaultMap (tcbFault tcb) = tcb_fault
 2. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; x11 = map_option fault_map tcb_fault; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 (map_option fault_map tcb_fault) x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>\<rbrakk> \<Longrightarrow> map_option FaultMap (map_option fault_map tcb_fault) = tcb_fault
 2. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>ptr. (\<exists>y. kheap s ptr = Some y) \<longrightarrow> (\<exists>obj. kheap s ptr = Some obj \<and> valid_obj ptr obj s)

goal (4 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; x11 = map_option fault_map tcb_fault; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 (map_option fault_map tcb_fault) x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>\<rbrakk> \<Longrightarrow> map_option FaultMap (map_option fault_map tcb_fault) = tcb_fault
 2. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; x11 = map_option fault_map tcb_fault; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 (map_option fault_map tcb_fault) x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> map_option FaultMap (map_option fault_map tcb_fault) = tcb_fault
 2. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 3. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>x. x \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s x = Some obj \<and> valid_obj x obj s)

goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>tcb y tcb' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 tcb_ctable tcb_vtable tcb_reply tcb_caller tcb_ipcframe tcb_state tcb_fault_handler tcb_ipc_buffer tcb_fault tcb_bound_notification tcb_mcpriority tcb_arch. \<lbrakk>kheap s y = Some (TCB \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>); tcb_fault_handler = to_bl x13; tcb_ipc_buffer = x14; arch_tcb_relation tcb_arch x16; thread_state_relation tcb_state x7; fault_rel_optionation tcb_fault x11; cap_relation tcb_ctable (cteCap x1); cap_relation tcb_vtable (cteCap x2); cap_relation tcb_reply (cteCap x3); cap_relation tcb_caller (cteCap x4); cap_relation tcb_ipcframe (cteCap x5); tcb_bound_notification = x15; tcb_mcpriority = x8; tcb = Thread x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16; tcb' = \<lparr>tcb_ctable = tcb_ctable, tcb_vtable = tcb_vtable, tcb_reply = tcb_reply, tcb_caller = tcb_caller, tcb_ipcframe = tcb_ipcframe, tcb_state = tcb_state, tcb_fault_handler = to_bl x13, tcb_ipc_buffer = x14, tcb_fault = tcb_fault, tcb_bound_notification = x15, tcb_mcpriority = x8, tcb_arch = tcb_arch\<rparr>; map_option FaultMap (tcbFault tcb) = tcb_fault; y \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> CapabilityMap (cteCap x1) = tcb_ctable \<and> CapabilityMap (cteCap x2) = tcb_vtable \<and> CapabilityMap (cteCap x3) = tcb_reply \<and> CapabilityMap (cteCap x4) = tcb_caller \<and> CapabilityMap (cteCap x5) = tcb_ipcframe \<and> map_option FaultMap x11 = tcb_fault \<and> ArchTcbMap x16 = tcb_arch
 2. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. absCNode sz (ksPSpace s') x) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x2 x7. \<lbrakk>x2 = KOCTE x7; ksPSpace s' x = Some (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x2 x7 y ko P. \<lbrakk>x2 = KOCTE x7; kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KOCTE x7)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P x5. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOCTE x7); ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x7 y ko P x5. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOCTE x7); ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x7 y ko P arch_kernel_obj. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOCTE x7); ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>x x2 x7 y ko P arch_kernel_obj x2a. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (PageTable x2a)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(8 \<rightarrow> 32) ya << 2), pte_relation ya)); P (ArchObj (PageTable x2a)) (KOCTE x7); ko = ArchObj (PageTable x2a); arch_kernel_obj = PageTable x2a\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P arch_kernel_obj x3. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOCTE x7); ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x7 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOCTE x7); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>x x2 x7 y ko P arch_kernel_obj x3. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOCTE x7); ko = ArchObj (PageDirectory x3); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOCTE x7); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x x2 x7 y ko P arch_kernel_obj x41 x42. \<lbrakk>x2 = KOCTE x7; kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOCTE x7); ko = ArchObj (DataPage x41 x42); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = cte_map (y, ya) \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x2 x7 y ko P x11 x12. \<lbrakk>P (CNode x11 x12) (KOCTE x7); ko = CNode x11 x12; x2 = KOCTE x7; kheap s y = Some (CNode x11 x12); well_formed_cnode_n x11 x12; \<exists>ya. x = y + of_bl ya * 2 ^ cte_level_bits \<and> P = cte_relation ya \<and> ya \<in> dom x12\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (x + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE cte) \<Rightarrow> cteCap cte)) else None)) (gsCNodes s' x) = kheap s x
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>x\<in>dom (kheap s). is_aligned x (obj_bits (the (kheap s x)))

goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (obj_bits (the (kheap s y)))\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz)\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE xa) \<Rightarrow> cteCap xa)) else None) = cs
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> (if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE xa) \<Rightarrow> cteCap xa)) else None) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> (length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl) \<and> (length bl \<noteq> sz \<longrightarrow> None = cs bl)
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl \<noteq> sz \<longrightarrow> None = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl \<noteq> sz \<longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>x. x \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s x = Some obj \<and> valid_obj x obj s)

goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl \<noteq> sz \<longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0; y \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> length bl \<noteq> sz \<longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); \<forall>a. (\<exists>y. cs a = Some y) = (length a = sz); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; length bl \<noteq> sz\<rbrakk> \<Longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); \<forall>a. (\<exists>y. cs a = Some y) = (length a = sz); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; length bl \<noteq> sz; length ya = sz\<rbrakk> \<Longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; length bl \<noteq> sz; length ya = sz; (\<exists>y. cs bl = Some y) = (length bl = sz)\<rbrakk> \<Longrightarrow> None = cs bl
 2. \<And>y ya sz yb cs cte bl. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> length bl = sz \<longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>(x', P)\<in>obj_relation_cuts (CNode (length bl) cs) y. \<exists>z. ksPSpace s' x' = Some z \<and> P (CNode (length bl) cs) z\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>a b. (\<exists>ya. a = y + of_bl ya * 2 ^ cte_level_bits \<and> b = cte_relation ya \<and> ya \<in> dom cs) \<longrightarrow> (\<exists>z. ksPSpace s' a = Some z \<and> b (CNode (length bl) cs) z)\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>b. (\<exists>ya. y + of_bl bl * 2 ^ cte_level_bits = y + of_bl ya * 2 ^ cte_level_bits \<and> b = cte_relation ya \<and> ya \<in> dom cs) \<longrightarrow> (\<exists>z. ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z \<and> b (CNode (length bl) cs) z)\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<forall>b. (\<exists>y. of_bl bl * 2 ^ cte_level_bits = of_bl y * 2 ^ cte_level_bits \<and> b = cte_relation y \<and> y \<in> dom cs) \<longrightarrow> (\<exists>z. ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z \<and> b (CNode (length bl) cs) z)\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; (\<exists>y. of_bl bl * 2 ^ cte_level_bits = of_bl y * 2 ^ cte_level_bits \<and> cte_relation bl = cte_relation y \<and> y \<in> dom cs) \<longrightarrow> (\<exists>z. ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z \<and> cte_relation bl (CNode (length bl) cs) z)\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0\<rbrakk> \<Longrightarrow> \<exists>y. of_bl bl * 2 ^ cte_level_bits = of_bl y * 2 ^ cte_level_bits \<and> cte_relation bl = cte_relation y \<and> y \<in> dom cs
 2. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<exists>z. ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z \<and> cte_relation bl (CNode (length bl) cs) z\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; \<exists>z. ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z \<and> cte_relation bl (CNode (length bl) cs) z\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl z. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some z; cte_relation bl (CNode (length bl) cs) z\<rbrakk> \<Longrightarrow> Some (CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) = cs bl
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> CapabilityMap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x) = cap
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> wellformed_cap cap
 2. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> cap_relation cap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>x. x \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s x = Some obj \<and> valid_obj x obj s)

goal (4 subgoals):
 1. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> wellformed_cap cap
 2. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> cap_relation cap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea); y \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> wellformed_cap cap
 2. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> cap_relation cap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea); \<forall>cap. (\<exists>a. cs a = Some cap) \<longrightarrow> cap_aligned cap \<and> wellformed_cap cap \<and> valid_cap_ref cap s; valid_cs_size (length bl) cs\<rbrakk> \<Longrightarrow> wellformed_cap cap
 2. \<And>y ya yb cs cte bl ctea cap. \<lbrakk>kheap s y = Some (CNode (length bl) cs); well_formed_cnode_n (length bl) cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length bl); is_aligned y (cte_level_bits + length bl); of_bl ya * 2 ^ cte_level_bits = 0; ksPSpace s' (y + of_bl bl * 2 ^ cte_level_bits) = Some (KOCTE ctea); cs bl = Some cap; cap_relation cap (cteCap ctea)\<rbrakk> \<Longrightarrow> cap_relation cap (case ksPSpace s' (y + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
using this:
\<forall>x. x \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s x = Some obj \<and> valid_obj x obj s)

goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0\<rbrakk> \<Longrightarrow> kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; y \<in> {a. kheap s a \<noteq> None} \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits\<rbrakk> \<Longrightarrow> kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits\<rbrakk> \<Longrightarrow> of_bl ya * 2 ^ cte_level_bits \<in> {0<..<2 ^ obj_bits (CNode sz cs)}
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits\<rbrakk> \<Longrightarrow> of_bl ya * 2 ^ cte_level_bits < 2 ^ sz * 2 ^ cte_level_bits
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); \<forall>a. (\<exists>y. cs a = Some y) = (length a = sz); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits\<rbrakk> \<Longrightarrow> of_bl ya * 2 ^ cte_level_bits < 2 ^ sz * 2 ^ cte_level_bits
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> of_bl ya * 2 ^ cte_level_bits < 2 ^ sz * 2 ^ cte_level_bits
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> of_bl ya < 2 ^ sz
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> 0 < 2 ^ cte_level_bits
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 4. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz); sz = length ya\<rbrakk> \<Longrightarrow> of_bl ya < 2 ^ sz
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> sz = length ya
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> 0 < 2 ^ cte_level_bits
 4. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 5. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (6 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode (length ya) cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some (length ya); is_aligned y (cte_level_bits + length ya); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; length ya < word_bits - cte_level_bits; sz = length ya\<rbrakk> \<Longrightarrow> of_bl ya < 2 ^ length ya
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> sz = length ya
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> 0 < 2 ^ cte_level_bits
 4. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 5. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 6. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (5 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> sz = length ya
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> 0 < 2 ^ cte_level_bits
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 4. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 5. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (4 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> 0 < 2 ^ cte_level_bits
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 3. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 4. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); 0 < of_bl ya * 2 ^ cte_level_bits; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < word_bits - cte_level_bits; (\<exists>y. cs ya = Some y) = (length ya = sz)\<rbrakk> \<Longrightarrow> unat (2 ^ sz) * unat (2 ^ cte_level_bits) < 2 ^ LENGTH(32)
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (4 + sz); 0 < of_bl ya * 0x10; \<forall>cap\<in>ran cs. s \<turnstile> cap; sz < 28; length ya = sz\<rbrakk> \<Longrightarrow> 2 ^ sz < 268435456
 2. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> map_option (\<lambda>sz. CNode sz (\<lambda>bl. if length bl = sz then Some (CapabilityMap (case ksPSpace s' (y + of_bl ya * 2 ^ cte_level_bits + of_bl bl * 2 ^ cteSizeBits) of Some (KOCTE x) \<Rightarrow> cteCap x)) else None)) (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits)) = kheap s (y + of_bl ya * 2 ^ cte_level_bits)
 3. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None\<rbrakk> \<Longrightarrow> gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits) = None
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte yc. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None; gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits) = Some yc\<rbrakk> \<Longrightarrow> False
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>y ya sz yb cs cte yc. \<lbrakk>kheap s y = Some (CNode sz cs); well_formed_cnode_n sz cs; cs ya = Some yb; cap_relation yb (cteCap cte); gsCNodes s' y = Some sz; is_aligned y (cte_level_bits + sz); of_bl ya * 2 ^ cte_level_bits \<noteq> 0; kheap s (y + of_bl ya * 2 ^ cte_level_bits) = None; gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits) = Some yc; (\<exists>cs. kheap s (y + of_bl ya * 2 ^ cte_level_bits) = Some (CNode yc cs) \<and> well_formed_cnode_n yc cs) = (gsCNodes s' (y + of_bl ya * 2 ^ cte_level_bits) = Some yc)\<rbrakk> \<Longrightarrow> False
 2. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x x2 x8. \<lbrakk>x2 = KOArch x8; ksPSpace s' x = Some (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x x8. ksPSpace s' x = Some (KOArch x8) \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x x8 y ko P. \<lbrakk>kheap s y = Some ko; (x, P) \<in> obj_relation_cuts ko y; P ko (KOArch x8)\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (2 subgoals):
 1. \<And>x x8 y ko P x11 x12. \<lbrakk>kheap s y = Some (CNode x11 x12); (x, P) \<in> (if well_formed_cnode_n x11 x12 then {(cte_map (y, ya), cte_relation ya) |ya. ya \<in> dom x12} else {(y, \<lambda>_ _. False)}); P (CNode x11 x12) (KOArch x8); ko = CNode x11 x12\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x
 2. \<And>x x8 y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOArch x8); ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x x8 y ko P x5. \<lbrakk>kheap s y = Some (ArchObj x5); (x, P) \<in> aobj_relation_cuts x5 y; P (ArchObj x5) (KOArch x8); ko = ArchObj x5\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x x8) = kheap s x proof (prove)
goal (1 subgoal):
 1. \<And>x arch_kernel_object y ko P arch_kernel_obj. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch arch_kernel_object); ko = ArchObj arch_kernel_obj\<rbrakk> \<Longrightarrow> map_option ArchObj (absHeapArch (ksPSpace s') x arch_kernel_object) = kheap s x proof (prove)
goal (3 subgoals):
 1. \<And>x arch_kernel_object y ko P arch_kernel_obj x1. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool x1)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOASIDPool x1\<rbrakk> \<Longrightarrow> \<forall>xa. x1 = asidpool.ASIDPool xa \<longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x y P arch_kernel_obj xa. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa)))\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (6 subgoals):
 1. \<And>x y P arch_kernel_obj xa x1. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = arch_kernel_obj.ASIDPool x1\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x y P arch_kernel_obj xa x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 3. \<And>x y P arch_kernel_obj xa x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 4. \<And>x y P arch_kernel_obj xa x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 6. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>x y P arch_kernel_obj xa x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x y P arch_kernel_obj xa x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 3. \<And>x y P arch_kernel_obj xa x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>x y P arch_kernel_obj xa x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x y P arch_kernel_obj xa x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 3. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x y P arch_kernel_obj xa x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOASIDPool (asidpool.ASIDPool xa))); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> Some (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>w. xa (UCAST(10 \<rightarrow> 32) w)))) = kheap s x
 2. \<And>x arch_kernel_object y ko P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2))\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x1. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = arch_kernel_obj.ASIDPool x1\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x2 x2a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageTable x2a\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x2a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageTable x2a\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
using this:
\<forall>x. x \<in> {a. kheap s a \<noteq> None} \<longrightarrow> is_aligned x (obj_bits (the (kheap s x)))

goal (4 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x2a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageTable x2a\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x2a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageTable x2a; y \<in> {a. kheap s a \<noteq> None} \<longrightarrow> is_aligned y (obj_bits (the (kheap s y)))\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> (is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))) \<and> (\<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> None = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2)))
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> None = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> None = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> None = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2)) = None
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> 0 < UCAST(8 \<rightarrow> 32) ya << 2 \<and> UCAST(8 \<rightarrow> 32) ya << 2 < 0x400
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> 32) ya << 2 < 0x400\<rbrakk> \<Longrightarrow> 0 < UCAST(8 \<rightarrow> 32) ya << 2
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10 \<longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> ?'c1285) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> UCAST(8 \<rightarrow> ?'c1285) ya << 2 = 0
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> UCAST(8 \<rightarrow> ?'c1285) ya << 2 = 0
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> ?'c1285) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> ?'c1285) ya << 2 \<noteq> 0\<rbrakk> \<Longrightarrow> False
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> ?'c1285) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (6 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> 32) ya << 2 \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(8 \<rightarrow> 32) ya << 2 < 2 ^ 10
 2. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> 32) ya << 2 \<noteq> 0; \<not> is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10\<rbrakk> \<Longrightarrow> False
 3. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; is_aligned (y + (UCAST(8 \<rightarrow> 32) ya << 2)) 10; UCAST(8 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageTable (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) ya << 2) + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)))) = kheap s (y + (UCAST(8 \<rightarrow> 32) ya << 2))
 4. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 6. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> (\<lambda>offs. case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; \<forall>(x', P)\<in>obj_relation_cuts (ArchObj (PageTable pt)) y. \<exists>z. ksPSpace s' x' = Some z \<and> P (ArchObj (PageTable pt)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; \<forall>x. \<exists>z. ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) x << 2)) = Some z \<and> pte_relation x (ArchObj (PageTable pt)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; \<exists>z. ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some z \<and> pte_relation offs (ArchObj (PageTable pt)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPTE ARM_H.InvalidPTE)) \<Rightarrow> ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.LargePagePTE p c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | Some (KOArch (KOPTE (ARM_H.SmallPagePTE p c g xn rights))) \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs ptea. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE ptea)); pte_relation_aligned offs (pt offs) ptea\<rbrakk> \<Longrightarrow> (case ptea of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
using this:
\<forall>ptr. (\<exists>y. kheap s ptr = Some y) \<longrightarrow> (\<exists>obj. kheap s ptr = Some obj \<and> valid_obj ptr obj s)

goal (4 subgoals):
 1. \<And>y ya pt pte offs ptea. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE ptea)); pte_relation_aligned offs (pt offs) ptea\<rbrakk> \<Longrightarrow> (case ptea of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs ptea. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE ptea)); pte_relation_aligned offs (pt offs) ptea; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> (case ptea of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs ptea. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE ptea)); pte_relation_aligned offs (pt offs) ptea; \<forall>x. case pt x of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage\<rbrakk> \<Longrightarrow> (case ptea of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs ptea. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE ptea)); pte_relation_aligned offs (pt offs) ptea; case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage\<rbrakk> \<Longrightarrow> (case ptea of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs pte'. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; pte_relation_aligned ya (pt ya) pte; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE pte')); pte_relation_aligned offs (pt offs) pte'; case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage\<rbrakk> \<Longrightarrow> (case pte' of ARM_H.InvalidPTE \<Rightarrow> ARM_A.InvalidPTE | ARM_H.LargePagePTE p c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.LargePagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPTE | ARM_H.SmallPagePTE p c g xn rights \<Rightarrow> ARM_A.SmallPagePTE p {x. c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights)) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte offs pte' x21 x22 x23 x24 x25. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); if is_aligned offs 4 then pte_relation' (pt offs) (ARM_H.LargePagePTE x21 x22 x23 x24 x25) else pt offs = ARM_A.InvalidPTE; case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage; pte' = ARM_H.LargePagePTE x21 x22 x23 x24 x25\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.LargePagePTE x21 {x. x22 \<and> x = PageCacheable \<or> x23 \<and> x = Global \<or> x24 \<and> x = XNever} (vm_rights_of x25) = pt offs
 2. \<And>y ya pt pte offs pte' x31 x32 x33 x34 x35. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 x32 x33 x34 x35))); pte_relation' (pt offs) (ARM_H.SmallPagePTE x31 x32 x33 x34 x35); case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage; pte' = ARM_H.SmallPagePTE x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ARM_A.SmallPagePTE x31 {x. x32 \<and> x = PageCacheable \<or> x33 \<and> x = Global \<or> x34 \<and> x = XNever} (vm_rights_of x35) = pt offs
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte offs x21 x22a x23a. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22a) (Global \<in> x22a) (XNever \<in> x22a) (vmrights_map x23a)))); pt offs = ARM_A.LargePagePTE x21 x22a x23a; ParityEnabled \<notin> x22a; x23a \<in> valid_vm_rights; vmsz_aligned x21 ARMLargePage; is_aligned offs 4\<rbrakk> \<Longrightarrow> {x. PageCacheable \<in> x22a \<and> x = PageCacheable \<or> Global \<in> x22a \<and> x = Global \<or> XNever \<in> x22a \<and> x = XNever} = x22a
 2. \<And>y ya pt pte offs pte' x31 x32 x33 x34 x35. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 x32 x33 x34 x35))); pte_relation' (pt offs) (ARM_H.SmallPagePTE x31 x32 x33 x34 x35); case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage; pte' = ARM_H.SmallPagePTE x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ARM_A.SmallPagePTE x31 {x. x32 \<and> x = PageCacheable \<or> x33 \<and> x = Global \<or> x34 \<and> x = XNever} (vm_rights_of x35) = pt offs
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pt pte offs x21 x22a x23a x. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22a) (Global \<in> x22a) (XNever \<in> x22a) (vmrights_map x23a)))); pt offs = ARM_A.LargePagePTE x21 x22a x23a; ParityEnabled \<notin> x22a; x23a \<in> valid_vm_rights; vmsz_aligned x21 ARMLargePage; is_aligned offs 4\<rbrakk> \<Longrightarrow> (PageCacheable \<in> x22a \<and> x = PageCacheable \<or> Global \<in> x22a \<and> x = Global \<or> XNever \<in> x22a \<and> x = XNever) = (x \<in> x22a)
 2. \<And>y ya pt pte offs pte' x31 x32 x33 x34 x35. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 x32 x33 x34 x35))); pte_relation' (pt offs) (ARM_H.SmallPagePTE x31 x32 x33 x34 x35); case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage; pte' = ARM_H.SmallPagePTE x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ARM_A.SmallPagePTE x31 {x. x32 \<and> x = PageCacheable \<or> x33 \<and> x = Global \<or> x34 \<and> x = XNever} (vm_rights_of x35) = pt offs
 3. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 5. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs pte' x31 x32 x33 x34 x35. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 x32 x33 x34 x35))); pte_relation' (pt offs) (ARM_H.SmallPagePTE x31 x32 x33 x34 x35); case pt offs of ARM_A.InvalidPTE \<Rightarrow> True | ARM_A.LargePagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMLargePage | ARM_A.SmallPagePTE p attr r \<Rightarrow> ParityEnabled \<notin> attr \<and> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSmallPage; pte' = ARM_H.SmallPagePTE x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ARM_A.SmallPagePTE x31 {x. x32 \<and> x = PageCacheable \<or> x33 \<and> x = Global \<or> x34 \<and> x = XNever} (vm_rights_of x35) = pt offs
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs x31 x32a x33a. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 (PageCacheable \<in> x32a) (Global \<in> x32a) (XNever \<in> x32a) (vmrights_map x33a)))); pt offs = ARM_A.SmallPagePTE x31 x32a x33a; ParityEnabled \<notin> x32a; x33a \<in> valid_vm_rights; vmsz_aligned x31 ARMSmallPage\<rbrakk> \<Longrightarrow> {x. PageCacheable \<in> x32a \<and> x = PageCacheable \<or> Global \<in> x32a \<and> x = Global \<or> XNever \<in> x32a \<and> x = XNever} = x32a
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pt pte offs x31 x32a x33a x. \<lbrakk>kheap s y = Some (ArchObj (PageTable pt)); is_aligned y 10; if is_aligned ya (case pte of ARM_H.LargePagePTE x xa xb xc xd \<Rightarrow> 4 | _ \<Rightarrow> 0) then pte_relation' (pt ya) pte else pt ya = ARM_A.InvalidPTE; UCAST(8 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(8 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPTE (ARM_H.SmallPagePTE x31 (PageCacheable \<in> x32a) (Global \<in> x32a) (XNever \<in> x32a) (vmrights_map x33a)))); pt offs = ARM_A.SmallPagePTE x31 x32a x33a; ParityEnabled \<notin> x32a; x33a \<in> valid_vm_rights; vmsz_aligned x31 ARMSmallPage\<rbrakk> \<Longrightarrow> (PageCacheable \<in> x32a \<and> x = PageCacheable \<or> Global \<in> x32a \<and> x = Global \<or> XNever \<in> x32a \<and> x = XNever) = (x \<in> x32a)
 2. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 4. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x3. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3)) (KOArch (KOPTE x2)); arch_kernel_obj = PageDirectory x3\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 3. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x2 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPTE x2)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pt_bits \<longrightarrow> Some (ArchObj (PageTable (absPageTable (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pt_bits \<longrightarrow> None = kheap s x)
 2. \<And>x arch_kernel_object y ko P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); ko = ArchObj arch_kernel_obj; arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (1 subgoal):
 1. \<And>x y P arch_kernel_obj x3. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3))\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x1. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = arch_kernel_obj.ASIDPool x1\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 4. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x2. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageTable x2\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
using this:
pspace_aligned s

goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3a)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3a)) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a; \<forall>x. (\<exists>y. kheap s x = Some y) \<longrightarrow> is_aligned x (obj_bits (the (kheap s x)))\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>x y P arch_kernel_obj x3 x3a. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory x3a)); (x, P) \<in> range (\<lambda>ya. (y + (UCAST(12 \<rightarrow> 32) ya << 2), pde_relation ya)); P (ArchObj (PageDirectory x3a)) (KOArch (KOPDE x3)); arch_kernel_obj = PageDirectory x3a; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> is_aligned y (obj_bits (the (kheap s y)))\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x)
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> (is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))) \<and> (\<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> None = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2)))
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> None = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> None = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> None = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2)) = None
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> 0 < UCAST(12 \<rightarrow> 32) ya << 2 \<and> UCAST(12 \<rightarrow> 32) ya << 2 < 0x4000
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> 32) ya << 2 < 0x4000\<rbrakk> \<Longrightarrow> 0 < UCAST(12 \<rightarrow> 32) ya << 2
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde\<rbrakk> \<Longrightarrow> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14 \<longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> ?'c1499) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> UCAST(12 \<rightarrow> ?'c1499) ya << 2 = 0
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> UCAST(12 \<rightarrow> ?'c1499) ya << 2 = 0
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> ?'c1499) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> ?'c1499) ya << 2 \<noteq> 0\<rbrakk> \<Longrightarrow> False
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> ?'c1499) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> 32) ya << 2 \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(12 \<rightarrow> 32) ya << 2 < 2 ^ 14
 2. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> 32) ya << 2 \<noteq> 0; \<not> is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14\<rbrakk> \<Longrightarrow> False
 3. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; is_aligned (y + (UCAST(12 \<rightarrow> 32) ya << 2)) 14; UCAST(12 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> Some (ArchObj (PageDirectory (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) ya << 2) + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE))) = kheap s (y + (UCAST(12 \<rightarrow> 32) ya << 2))
 4. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj arch_kernel_obj); (x, P) \<in> aobj_relation_cuts arch_kernel_obj y; P (ArchObj arch_kernel_obj) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> (\<lambda>offs. case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; \<forall>(x', P)\<in>obj_relation_cuts (ArchObj (PageDirectory pd)) y. \<exists>z. ksPSpace s' x' = Some z \<and> P (ArchObj (PageDirectory pd)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; \<forall>x. \<exists>z. ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) x << 2)) = Some z \<and> pde_relation x (ArchObj (PageDirectory pd)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; \<exists>z. ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some z \<and> pde_relation offs (ArchObj (PageDirectory pd)) z\<rbrakk> \<Longrightarrow> (case ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) of Some (KOArch (KOPDE ARM_H.InvalidPDE)) \<Rightarrow> ARM_A.InvalidPDE | Some (KOArch (KOPDE (ARM_H.PageTablePDE p e x))) \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | Some (KOArch (KOPDE (ARM_H.SectionPDE p e mw c g xn rights))) \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | Some (KOArch (KOPDE (ARM_H.SuperSectionPDE p e c g xn rights))) \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pdea. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pdea)); pde_relation_aligned offs (pd offs) pdea\<rbrakk> \<Longrightarrow> (case pdea of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
using this:
\<forall>ptr. (\<exists>y. kheap s ptr = Some y) \<longrightarrow> (\<exists>obj. kheap s ptr = Some obj \<and> valid_obj ptr obj s)

goal (2 subgoals):
 1. \<And>y ya pd pde offs pdea. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pdea)); pde_relation_aligned offs (pd offs) pdea\<rbrakk> \<Longrightarrow> (case pdea of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pdea. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pdea)); pde_relation_aligned offs (pd offs) pdea; (\<exists>ya. kheap s y = Some ya) \<longrightarrow> (\<exists>obj. kheap s y = Some obj \<and> valid_obj y obj s)\<rbrakk> \<Longrightarrow> (case pdea of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pdea. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pdea)); pde_relation_aligned offs (pd offs) pdea; \<forall>x. case pd x of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection\<rbrakk> \<Longrightarrow> (case pdea of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pdea. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pdea)); pde_relation_aligned offs (pd offs) pdea; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection\<rbrakk> \<Longrightarrow> (case pdea of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pde'. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; pde_relation_aligned ya (pd ya) pde; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE pde')); pde_relation_aligned offs (pd offs) pde'; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection\<rbrakk> \<Longrightarrow> (case pde' of ARM_H.InvalidPDE \<Rightarrow> ARM_A.InvalidPDE | ARM_H.PageTablePDE p e x \<Rightarrow> ARM_A.PageTablePDE p {x. e \<and> x = ParityEnabled} x | ARM_H.SectionPDE p e mw c g xn rights \<Rightarrow> ARM_A.SectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} mw (vm_rights_of rights) | ARM_H.SuperSectionPDE p e c g xn rights \<Rightarrow> if is_aligned offs 4 then ARM_A.SuperSectionPDE p {x. e \<and> x = ParityEnabled \<or> c \<and> x = PageCacheable \<or> g \<and> x = Global \<or> xn \<and> x = XNever} (vm_rights_of rights) else ARM_A.InvalidPDE) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (5 subgoals):
 1. \<And>y ya pd pde offs pde'. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE ARM_H.InvalidPDE)); pde_relation' (pd offs) ARM_H.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ARM_A.InvalidPDE = pd offs
 2. \<And>y ya pd pde offs pde' x21 x22 x23. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.PageTablePDE x21 x22 x23))); pde_relation' (pd offs) (ARM_H.PageTablePDE x21 x22 x23); case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ARM_A.PageTablePDE x21 {x. x = ParityEnabled \<and> x22} x23 = pd offs
 3. \<And>y ya pd pde offs pde' x31 x32 x33 x34 x35 x36 x37. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37))); pde_relation' (pd offs) (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37); case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ARM_A.SectionPDE x31 {x. x32 \<and> x = ParityEnabled \<or> x34 \<and> x = PageCacheable \<or> x35 \<and> x = Global \<or> x36 \<and> x = XNever} x33 (vm_rights_of x37) = pd offs
 4. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 5. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (4 subgoals):
 1. \<And>y ya pd pde offs x21 x23 x22a. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.PageTablePDE x21 (ParityEnabled \<in> x22a) x23))); pd offs = ARM_A.PageTablePDE x21 x22a x23; x22a \<subseteq> {ParityEnabled}; is_aligned x21 pt_bits\<rbrakk> \<Longrightarrow> {x. x = ParityEnabled \<and> ParityEnabled \<in> x22a} = x22a
 2. \<And>y ya pd pde offs pde' x31 x32 x33 x34 x35 x36 x37. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37))); pde_relation' (pd offs) (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37); case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ARM_A.SectionPDE x31 {x. x32 \<and> x = ParityEnabled \<or> x34 \<and> x = PageCacheable \<or> x35 \<and> x = Global \<or> x36 \<and> x = XNever} x33 (vm_rights_of x37) = pd offs
 3. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 4. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde offs pde' x31 x32 x33 x34 x35 x36 x37. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37))); pde_relation' (pd offs) (ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37); case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ARM_A.SectionPDE x31 {x. x32 \<and> x = ParityEnabled \<or> x34 \<and> x = PageCacheable \<or> x35 \<and> x = Global \<or> x36 \<and> x = XNever} x33 (vm_rights_of x37) = pd offs
 2. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde offs x31 x33 x32a x34a. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SectionPDE x31 (ParityEnabled \<in> x32a) x33 (PageCacheable \<in> x32a) (Global \<in> x32a) (XNever \<in> x32a) (vmrights_map x34a)))); pd offs = ARM_A.SectionPDE x31 x32a x33 x34a; x34a \<in> valid_vm_rights; vmsz_aligned x31 ARMSection\<rbrakk> \<Longrightarrow> {x. ParityEnabled \<in> x32a \<and> x = ParityEnabled \<or> PageCacheable \<in> x32a \<and> x = PageCacheable \<or> Global \<in> x32a \<and> x = Global \<or> XNever \<in> x32a \<and> x = XNever} = x32a
 2. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (3 subgoals):
 1. \<And>y ya pd pde offs x31 x33 x32a x34a x. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SectionPDE x31 (ParityEnabled \<in> x32a) x33 (PageCacheable \<in> x32a) (Global \<in> x32a) (XNever \<in> x32a) (vmrights_map x34a)))); pd offs = ARM_A.SectionPDE x31 x32a x33 x34a; x34a \<in> valid_vm_rights; vmsz_aligned x31 ARMSection\<rbrakk> \<Longrightarrow> (ParityEnabled \<in> x32a \<and> x = ParityEnabled \<or> PageCacheable \<in> x32a \<and> x = PageCacheable \<or> Global \<in> x32a \<and> x = Global \<or> XNever \<in> x32a \<and> x = XNever) = (x \<in> x32a)
 2. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 3. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs pde' x41 x42 x43 x44 x45 x46. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); if is_aligned offs 4 then pde_relation' (pd offs) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46) else pd offs = ARM_A.InvalidPDE; case pd offs of ARM_A.InvalidPDE \<Rightarrow> True | ARM_A.PageTablePDE p attr mw \<Rightarrow> attr \<subseteq> {ParityEnabled} \<and> is_aligned p pt_bits | ARM_A.SectionPDE p attr mw r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSection | ARM_A.SuperSectionPDE p attr r \<Rightarrow> r \<in> valid_vm_rights \<and> vmsz_aligned p ARMSuperSection; pde' = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> is_aligned offs 4 \<longrightarrow> ARM_A.SuperSectionPDE x41 {x. x42 \<and> x = ParityEnabled \<or> x43 \<and> x = PageCacheable \<or> x44 \<and> x = Global \<or> x45 \<and> x = XNever} (vm_rights_of x46) = pd offs
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs x41 x42a x43a. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42a) (PageCacheable \<in> x42a) (Global \<in> x42a) (XNever \<in> x42a) (vmrights_map x43a)))); pd offs = ARM_A.SuperSectionPDE x41 x42a x43a; x43a \<in> valid_vm_rights; vmsz_aligned x41 ARMSuperSection; is_aligned offs 4\<rbrakk> \<Longrightarrow> {x. ParityEnabled \<in> x42a \<and> x = ParityEnabled \<or> PageCacheable \<in> x42a \<and> x = PageCacheable \<or> Global \<in> x42a \<and> x = Global \<or> XNever \<in> x42a \<and> x = XNever} = x42a
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (2 subgoals):
 1. \<And>y ya pd pde offs x41 x42a x43a x. \<lbrakk>kheap s y = Some (ArchObj (PageDirectory pd)); is_aligned y 14; if is_aligned ya (case pde of ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> 4 | _ \<Rightarrow> 0) then pde_relation' (pd ya) pde else pd ya = ARM_A.InvalidPDE; UCAST(12 \<rightarrow> 32) ya << 2 = 0; ksPSpace s' (y + (UCAST(12 \<rightarrow> 32) offs << 2)) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42a) (PageCacheable \<in> x42a) (Global \<in> x42a) (XNever \<in> x42a) (vmrights_map x43a)))); pd offs = ARM_A.SuperSectionPDE x41 x42a x43a; x43a \<in> valid_vm_rights; vmsz_aligned x41 ARMSuperSection; is_aligned offs 4\<rbrakk> \<Longrightarrow> (ParityEnabled \<in> x42a \<and> x = ParityEnabled \<or> PageCacheable \<in> x42a \<and> x = PageCacheable \<or> Global \<in> x42a \<and> x = Global \<or> XNever \<in> x42a \<and> x = XNever) = (x \<in> x42a)
 2. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal (1 subgoal):
 1. \<And>x y P arch_kernel_obj x3 x41 x42. \<lbrakk>kheap s y = Some (ArchObj (DataPage x41 x42)); \<exists>n. x = y + n * 2 ^ pageBits \<and> P = (\<lambda>_ obj. obj = (if x41 then KOUserDataDevice else KOUserData)) \<and> n < 2 ^ (pageBitsForSize x42 - pageBits); P (ArchObj (DataPage x41 x42)) (KOArch (KOPDE x3)); arch_kernel_obj = DataPage x41 x42\<rbrakk> \<Longrightarrow> (is_aligned x pd_bits \<longrightarrow> Some (ArchObj (PageDirectory (absPageDirectory (ksPSpace s') x))) = kheap s x) \<and> (\<not> is_aligned x pd_bits \<longrightarrow> None = kheap s x) proof (prove)
goal:
No subgoals! proof (state)
this:
absHeap (gsUserPages s') (gsCNodes s') (ksPSpace s') = kheap s

goal:
No subgoals!