theory ArchAcc_AI

lemma set_pt_valid_vs_lookup [wp]:
  "\<lbrace>\<lambda>s. valid_vs_lookup s \<and> valid_arch_state s \<and>
        valid_vspace_objs s \<and> ((\<exists>\<rhd> p) s \<longrightarrow> (\<forall>x. valid_pte (pt x) s)) \<and>
        (\<forall>ref. (ref \<unrhd> p) s \<longrightarrow>
            (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow>
                    (\<exists>p' cap. caps_of_state s p' = Some cap \<and>
                         p \<in> obj_refs cap \<and>
                         vs_cap_ref cap =
                         Some (VSRef (ucast x) (Some APageTable) # ref))))\<rbrace>
   set_pt p pt
   \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace>" using set_pt_valid_vspace_objs[of p pt] set_pt_valid_arch_state[of p pt] apply (clarsimp simp: valid_def simpler_set_pt_def) apply (drule_tac x=s in spec)+ apply (clarsimp simp: valid_vs_lookup_def  split: if_split_asm) apply (erule (1) vs_lookup_pagesE_alt) apply (clarsimp simp: valid_arch_state_def valid_asid_table_def
                            fun_upd_def) apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast a) None]" in spec)+ apply simp apply (drule vs_lookup_pages_atI) apply simp apply (subst caps_of_state_after_update, simp add: obj_at_def) apply simp apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast b) (Some AASIDPool),
                         VSRef (ucast a) None]" in spec)+ apply simp apply (drule vs_lookup_pages_apI) apply (simp split: if_split_asm) apply simp+ apply (subst caps_of_state_after_update, simp add: obj_at_def) apply simp apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast c) (Some APageDirectory),
                        VSRef (ucast b) (Some AASIDPool),
                        VSRef (ucast a) None]" in spec)+ apply simp apply (drule vs_lookup_pages_pdI) apply (simp split: if_split_asm)+ apply (subst caps_of_state_after_update, simp add: obj_at_def) apply fastforce apply (clarsimp simp: fun_upd_def  split: if_split_asm) apply (thin_tac "valid_vspace_objs s" for s, thin_tac "valid_arch_state s" for s) apply (subst caps_of_state_after_update, simp add: obj_at_def) apply (thin_tac "\<forall>p ref. P p ref" for P) apply (drule_tac x="[VSRef (ucast c) (Some APageDirectory),
                        VSRef (ucast b) (Some AASIDPool),
                        VSRef (ucast a) None]" in spec) apply (thin_tac "valid_pte pte s" for pte s) apply (erule impE, fastforce intro: vs_lookup_pdI) apply (drule_tac x=d in spec) apply (erule impE) apply (erule (5) vs_lookup_pdI[THEN vs_lookup_pages_vs_lookupI]) apply (drule spec, drule spec, erule impE, assumption) apply assumption apply (thin_tac "valid_vspace_objs s" for s, thin_tac "valid_arch_state s" for s) apply (subst caps_of_state_after_update, simp add: obj_at_def) apply (thin_tac "\<forall>ref. (ref \<unrhd> p) s \<longrightarrow> P ref" for P) apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast d) (Some APageTable),
                       VSRef (ucast c) (Some APageDirectory),
                       VSRef (ucast b) (Some AASIDPool),
                       VSRef (ucast a) None]" in spec) apply (thin_tac "(\<exists>\<rhd> p) s \<longrightarrow> P" for P) apply (erule impE, fastforce intro: vs_lookup_pages_ptI) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_vs_lookup s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s)) \<and> (\<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))))\<rbrace> set_pt p pt \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace> proof (prove)
using this:
\<lbrace>\<lambda>s. valid_vspace_objs s \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s))\<rbrace> set_pt p pt \<lbrace>\<lambda>_. valid_vspace_objs\<rbrace>
\<lbrace>valid_arch_state\<rbrace> set_pt p pt \<lbrace>\<lambda>_. valid_arch_state\<rbrace>

goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_vs_lookup s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s)) \<and> (\<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))))\<rbrace> set_pt p pt \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s pta. \<lbrakk>\<forall>s. valid_vspace_objs s \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s)) \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pt. kheap s p = Some (ArchObj (PageTable pt)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_vspace_objs s'); \<forall>s. valid_arch_state s \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pt. kheap s p = Some (ArchObj (PageTable pt)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_arch_state s'); kheap s p = Some (ArchObj (PageTable pta)); valid_vs_lookup s; valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref)))\<rbrakk> \<Longrightarrow> valid_vs_lookup (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s pta. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_vs_lookup s; valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs s \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s)) \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pt. kheap s p = Some (ArchObj (PageTable pt)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_vspace_objs s'); valid_arch_state s \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pt. kheap s p = Some (ArchObj (PageTable pt)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_arch_state s')\<rbrakk> \<Longrightarrow> valid_vs_lookup (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa ref. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (ref \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref) proof (prove)
goal (5 subgoals):
 1. \<And>s pta pa ref. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>pa\<in>ran (asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)). typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)
 2. \<And>s pta pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 5. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table s a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(7 \<rightarrow> 32) a) None])); \<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]; ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa a. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(7 \<rightarrow> 32) a) None])); \<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]; ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (5 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap56 s pta pa a p\<^sub>1 ap b)))
 2. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ?ap56 s pta pa a p\<^sub>1 ap b (?b56 s pta pa a p\<^sub>1 ap b) = Some (?p56 s pta pa a p\<^sub>1 ap b)
 3. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) (?b56 s pta pa a p\<^sub>1 ap b)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p56 s pta pa a p\<^sub>1 ap b) s\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 5. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ap (?b56 s pta pa a p\<^sub>1 ap b) = Some (?p56 s pta pa a p\<^sub>1 ap b)
 2. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) (?b56 s pta pa a p\<^sub>1 ap b)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p56 s pta pa a p\<^sub>1 ap b) s\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (7 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)))
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ?ap81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c (?b81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c) = Some (?p\<^sub>281 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)
 3. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> kheap s (?p\<^sub>281 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c) = Some (ArchObj (PageDirectory (?pd81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)))
 4. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ?c81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c \<notin> kernel_mapping_slots
 5. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> pde_ref_pages (?pd81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c (?c81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)) = Some (?p81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)
 6. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageTable pt)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(12 \<rightarrow> 32) (?c81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) (?b81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p81 s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 7. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c aa ba cap. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s; kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); p\<^sub>1 \<noteq> p; caps_of_state s (aa, ba) = Some cap; pa \<in> obj_refs cap; vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c aa ba cap. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some pa; valid_pde (pd c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s; kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); p\<^sub>1 \<noteq> p; caps_of_state s (aa, ba) = Some cap; pa \<in> obj_refs cap; vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa ref a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pd)); c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageTable pt))\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := \<lambda>x. if x = ptrFromPAddr addr then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> ptrFromPAddr addr) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); \<forall>x. valid_pte (pt x) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ptrFromPAddr addr) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); valid_pte (pt d) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (3 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; valid_pte (pt d) s\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ptrFromPAddr addr) s
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; valid_pte (pt d) s; \<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 3. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; valid_pte (pt d) s; \<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (pt d) = Some pa; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> ptrFromPAddr addr; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); p = ptrFromPAddr addr; valid_pte (pt d) s; \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>valid_vspace_objs (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); valid_arch_state (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state (s\<lparr>kheap := \<lambda>a. if a = p then Some (ArchObj (PageTable pt)) else kheap s a\<rparr>) (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x p. pte_ref_pages (pt x) = Some p \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) x) (Some APageTable) # ref))); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x. valid_pte (pt x) s); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); ([VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); ([VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pta pa a p\<^sub>1 ap b p\<^sub>2 pd c addr x y ptaa d. \<lbrakk>asid_table s a = Some p\<^sub>1; ap b = Some p\<^sub>2; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; pte_ref_pages (ptaa d) = Some pa; valid_pte (ptaa d) (s\<lparr>kheap := \<lambda>x. if x = p then Some (ArchObj (PageTable pt)) else kheap s x\<rparr>); kheap s p = Some (ArchObj (PageTable pta)); valid_arch_state s; valid_vspace_objs s; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pd)); ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable ptaa)); [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal:
No subgoals!