theory ArchAcc_R

lemma setObject_PD_corres [@lift_corres_args, corres]:
  "pde_relation_aligned (p>>2) pde pde' \<Longrightarrow>
         corres dc  (ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits)
                     and pspace_aligned and valid_etcbs)
                    (pde_at' p)
          (set_pd (p && ~~ mask pd_bits) (pd(ucast (p && mask pd_bits >> 2) := pde)))
          (setObject p pde')" apply (simp add: set_pd_def set_object_def get_object_def bind_assoc
                   a_type_def[split_simps kernel_object.split arch_kernel_obj.split]) apply (rule corres_no_failI) apply (rule no_fail_pre, wp) apply simp apply (clarsimp simp: obj_at'_def ko_wp_at'_def typ_at'_def lookupAround2_known1 projectKOs) apply (case_tac ko, simp_all)[1] apply (rename_tac arch_kernel_object) apply (case_tac arch_kernel_object, simp_all add: projectKOs)[1] apply (simp add: objBits_simps archObjSize_def word_bits_def) apply (clarsimp simp: setObject_def in_monad split_def updateObject_default_def projectKOs) apply (simp add: in_magnitude_check objBits_simps archObjSize_def pageBits_def pdeBits_def) apply (clarsimp simp: obj_at_def exec_gets) apply (clarsimp simp: set_object_def bind_assoc exec_get) apply (clarsimp simp: put_def) apply (clarsimp simp: state_relation_def mask_pd_bits_inner_beauty) apply (rule conjI) apply (clarsimp simp: pspace_relation_def split del: if_split) apply (rule conjI) apply (subst pspace_dom_update, assumption) apply (simp add: a_type_def) apply (auto simp: dom_def)[1] apply (rule conjI) apply (drule bspec, blast) apply clarsimp apply (drule_tac x = x in spec) apply (clarsimp simp: pde_relation_def mask_pd_bits_inner_beauty pde_relation_aligned_simp
      dest!: more_pd_inner_beauty) apply (rule ballI) apply (drule (1) bspec) apply clarsimp apply (rule conjI) apply (clarsimp simp: pde_relation_def mask_pd_bits_inner_beauty pde_relation_aligned_simp
      dest!: more_pd_inner_beauty) apply clarsimp apply (drule bspec, assumption) apply clarsimp apply (erule (1) obj_relation_cutsE) apply simp apply simp apply clarsimp apply (frule (1) pspace_alignedD) apply (drule_tac p=x in pspace_alignedD, assumption) apply simp apply (drule mask_alignment_ugliness) apply (simp add: pd_bits_def pageBits_def) apply (simp add: pd_bits_def pageBits_def) apply clarsimp apply (drule test_bit_size) apply (clarsimp simp: word_size pd_bits_def pageBits_def) apply arith apply (simp split: if_split_asm) apply (simp split: if_split_asm) apply (simp add: other_obj_relation_def
               split: Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (rule conjI) apply (clarsimp simp: ekheap_relation_def pspace_relation_def) apply (drule(1) ekheap_kheap_dom) apply clarsimp apply (drule_tac x=p in bspec, erule domI) apply (simp add: other_obj_relation_def
           split: Structures_A.kernel_object.splits) apply (rule conjI) apply (clarsimp simp add: ghost_relation_def) apply (erule_tac x="p && ~~ mask pd_bits" in allE)+ apply fastforce apply (simp add: map_to_ctes_upd_other) apply (simp add: fun_upd_def) apply (simp add: caps_of_state_after_update obj_at_def swp_cte_at_caps_of) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> corres dc (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) (pde_at' p) (set_pd (p && ~~ mask pd_bits) (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))) (setObject p pde') proof (prove)
goal (1 subgoal):
 1. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> corres dc (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) (pde_at' p) (do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) (setObject p pde') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; True\<rbrakk> \<Longrightarrow> no_fail (pde_at' p) (setObject p pde')
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; True\<rbrakk> \<Longrightarrow> updateObject pde' = updateObject_default pde'
 2. \<And>s. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; True; pde_at' p s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>k. objBits k = objBits pde') p s
 3. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; True; pde_at' p s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>k. objBits k = objBits pde') p s
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; ksPSpace s p = Some ko; is_aligned p (objBitsKO ko); koTypeOf ko = ArchT PDET; ps_clear p (objBitsKO ko) s\<rbrakk> \<Longrightarrow> \<exists>obj. ko = KOArch (KOPDE obj) \<and> objBits obj = objBits pde'
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko x8. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; ksPSpace s p = Some (KOArch x8); is_aligned p (objBitsKO (KOArch x8)); archTypeOf x8 = PDET; ps_clear p (objBitsKO (KOArch x8)) s; ko = KOArch x8\<rbrakk> \<Longrightarrow> \<exists>obj. x8 = KOPDE obj \<and> objBits obj = objBits pde'
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; ksPSpace s p = Some (KOArch arch_kernel_object); is_aligned p (objBitsKO (KOArch arch_kernel_object)); archTypeOf arch_kernel_object = PDET; ps_clear p (objBitsKO (KOArch arch_kernel_object)) s; ko = KOArch arch_kernel_object\<rbrakk> \<Longrightarrow> \<exists>obj. arch_kernel_object = KOPDE obj \<and> objBits obj = objBits pde'
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object x3. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; ksPSpace s p = Some (KOArch (KOPDE x3)); is_aligned p (objBitsKO (KOArch (KOPDE x3))); ps_clear p (objBitsKO (KOArch (KOPDE x3))) s; ko = KOArch (KOPDE x3); arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> objBits x3 = objBits pde'
 2. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. pde_relation_aligned (p >> 2) pde pde' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (ako_at (PageDirectory pd) (p && ~~ mask pd_bits) and pspace_aligned and valid_etcbs) s \<and> pde_at' p s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setObject p pde' s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_ s''. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; (a, b) \<in> state_relation; ako_at (PageDirectory pd) (p && ~~ mask pd_bits) a; pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p (objBits pde'); ((), s'') \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits pde') b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) a). (snd x, s''\<lparr>ksPSpace := (ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))\<rparr>) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; (a, b) \<in> state_relation; ako_at (PageDirectory pd) (p && ~~ mask pd_bits) a; pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
y <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
y <- assert ((case the (x (p && ~~ mask pd_bits)) of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory);
s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) a). (snd x, b\<lparr>ksPSpace := (ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))\<rparr>) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; (a, b) \<in> state_relation; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do s <- get;
put (s\<lparr>kheap := (kheap s)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)
od) a). (snd x, b\<lparr>ksPSpace := (ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))\<rparr>) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; (a, b) \<in> state_relation; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (put (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>) a). (snd x, b\<lparr>ksPSpace := (ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))\<rparr>) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; (a, b) \<in> state_relation; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b\<rbrakk> \<Longrightarrow> (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>, b\<lparr>ksPSpace := (ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))\<rparr>) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> pspace_dom ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) = insert p (dom (ksPSpace b)) \<and> (\<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))) \<and> (\<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y)))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> pspace_dom ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) = insert p (dom (ksPSpace b))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> (\<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))) \<and> (\<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y)))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> a_type (ArchObj (PageDirectory pd)) = a_type (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> pspace_dom (kheap a) = insert p (dom (ksPSpace b))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> (\<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))) \<and> (\<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y)))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> pspace_dom (kheap a) = insert p (dom (ksPSpace b))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> (\<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))) \<and> (\<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y)))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> (\<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))) \<and> (\<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y)))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts (the (kheap a (p && ~~ mask pd_bits))) (p && ~~ mask pd_bits). case x of (y, P) \<Rightarrow> P (the (kheap a (p && ~~ mask pd_bits))) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x. pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (if (p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p then Some (KOArch (KOPDE pde')) else ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_ x. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x. pde_relation x (ArchObj (PageDirectory pd)) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))\<rbrakk> \<Longrightarrow> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (KOArch (KOPDE pde'))) \<and> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) \<noteq> p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2)))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_ x. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); pde_relation x (ArchObj (PageDirectory pd)) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))\<rbrakk> \<Longrightarrow> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (KOArch (KOPDE pde'))) \<and> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) \<noteq> p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2)))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y)); x \<in> dom (kheap a)\<rbrakk> \<Longrightarrow> \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); x \<in> dom (kheap a); \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> \<forall>xa\<in>obj_relation_cuts (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) else kheap a x)) (the (if y = p then Some (KOArch (KOPDE pde')) else ksPSpace b y))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya)); kheap a x = Some y\<rbrakk> \<Longrightarrow> (x = p && ~~ mask pd_bits \<longrightarrow> (\<forall>x. ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (KOArch (KOPDE pde'))) \<and> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) \<noteq> p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))))) \<and> (x \<noteq> p && ~~ mask pd_bits \<longrightarrow> (\<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (if ya = p then Some (KOArch (KOPDE pde')) else ksPSpace b ya))))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_ x y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya)); kheap a x = Some y\<rbrakk> \<Longrightarrow> x = p && ~~ mask pd_bits \<longrightarrow> (\<forall>x. ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) = p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (KOArch (KOPDE pde'))) \<and> ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2) \<noteq> p \<longrightarrow> pde_relation x (ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde)))) (the (ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) x << 2))))))
 2. \<And>a b uu_ x y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya)); kheap a x = Some y\<rbrakk> \<Longrightarrow> x \<noteq> p && ~~ mask pd_bits \<longrightarrow> (\<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (if ya = p then Some (KOArch (KOPDE pde')) else ksPSpace b ya)))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya)); kheap a x = Some y\<rbrakk> \<Longrightarrow> x \<noteq> p && ~~ mask pd_bits \<longrightarrow> (\<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (if ya = p then Some (KOArch (KOPDE pde')) else ksPSpace b ya)))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y aa ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>obj_relation_cuts y x. case x of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya)); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; (aa, ba) \<in> obj_relation_cuts y x\<rbrakk> \<Longrightarrow> (aa = p \<longrightarrow> ba y (KOArch (KOPDE pde'))) \<and> (aa \<noteq> p \<longrightarrow> ba y (the (ksPSpace b aa)))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y aa ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; (aa, ba) \<in> obj_relation_cuts y x; case (aa, ba) of (ya, P) \<Rightarrow> P y (the (ksPSpace b ya))\<rbrakk> \<Longrightarrow> (aa = p \<longrightarrow> ba y (KOArch (KOPDE pde'))) \<and> (aa \<noteq> p \<longrightarrow> ba y (the (ksPSpace b aa)))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; (p, ba) \<in> obj_relation_cuts y x; ba y (KOArch (KOPDE uu_))\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b uu_ x y ba sz cs z cap cte. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = CNode sz cs; well_formed_cnode_n sz cs; p = cte_map (x, z); KOArch (KOPDE uu_) = KOCTE cte; cs z = Some cap; cap_relation cap (cteCap cte)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba pt z pte'. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (PageTable pt); p = x + (UCAST(8 \<rightarrow> 32) z << 2); KOArch (KOPDE uu_) = KOArch (KOPTE pte'); pte_relation_aligned z (pt z) pte'\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba pda z pde'a. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (PageDirectory pda); p = x + (UCAST(12 \<rightarrow> 32) z << 2); KOArch (KOPDE uu_) = KOArch (KOPDE pde'a); pde_relation_aligned z (pda z) pde'a\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 6. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b uu_ x y ba pt z pte'. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (PageTable pt); p = x + (UCAST(8 \<rightarrow> 32) z << 2); KOArch (KOPDE uu_) = KOArch (KOPTE pte'); pte_relation_aligned z (pt z) pte'\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba pda z pde'a. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (PageDirectory pda); p = x + (UCAST(12 \<rightarrow> 32) z << 2); KOArch (KOPDE uu_) = KOArch (KOPDE pde'a); pde_relation_aligned z (pda z) pde'a\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b uu_ x y ba pda z pde'a. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (PageDirectory pda); p = x + (UCAST(12 \<rightarrow> 32) z << 2); KOArch (KOPDE uu_) = KOArch (KOPDE pde'a); pde_relation_aligned z (pda z) pde'a\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some (ArchObj (PageDirectory pda)); x \<noteq> x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits; ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some (ArchObj (PageDirectory pda)); x \<noteq> x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits; ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) (obj_bits (ArchObj (PageDirectory pd)))\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); x \<noteq> x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits; ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) (obj_bits (ArchObj (PageDirectory pd))); is_aligned x (obj_bits (ArchObj (PageDirectory pda)))\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); x \<noteq> x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits; ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (7 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) pd_bits
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 3. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> \<forall>n\<ge>pd_bits. \<not> (UCAST(12 \<rightarrow> 32) z << 2) !! n
 4. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 5. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 6. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 7. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> \<forall>n\<ge>pd_bits. \<not> (UCAST(12 \<rightarrow> 32) z << 2) !! n
 3. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 6. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14\<rbrakk> \<Longrightarrow> \<forall>n\<ge>pd_bits. \<not> (UCAST(12 \<rightarrow> 32) z << 2) !! n
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b x ba pda z pde'a n. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; pd_bits \<le> n; n - 2 < 32; n < 32; 2 \<le> n; z !! (n - 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b x ba pda z pde'a n. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; pd_bits \<le> n; n - 2 < 32; n < 32; 2 \<le> n; n - 2 < size z\<rbrakk> \<Longrightarrow> False
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b x ba pda z pde'a n. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned x 14; 14 \<le> n; n < 32; n - 2 < 12\<rbrakk> \<Longrightarrow> False
 2. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 5. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b x ba pda z pde'a. \<lbrakk>pde_relation_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) >> 2) pde pde'; kheap a (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' (x + (UCAST(12 \<rightarrow> 32) z << 2)) b; ksPSpace b (x + (UCAST(12 \<rightarrow> 32) z << 2)) = Some (KOArch (KOPDE pde'a)); is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2; ps_clear (x + (UCAST(12 \<rightarrow> 32) z << 2)) 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'a)); p = x + (UCAST(12 \<rightarrow> 32) z << 2); pde_relation_aligned z (pda z) pde'a; is_aligned (x + (UCAST(12 \<rightarrow> 32) z << 2) && ~~ mask pd_bits) 14; is_aligned x 14; False\<rbrakk> \<Longrightarrow> ba (ArchObj (PageDirectory pda)) (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 4. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b uu_ x y ba sz dev n. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); y = ArchObj (DataPage dev sz); KOArch (KOPDE uu_) = (if dev then KOUserDataDevice else KOUserData); p = x + n * 2 ^ pageBits; n < 2 ^ (pageBitsForSize sz - pageBits)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 3. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ x y ba. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a x = Some y; x \<noteq> p && ~~ mask pd_bits; ba y (KOArch (KOPDE uu_)); p = x; other_obj_relation y (KOArch (KOPDE uu_)); is_other_obj_relation_type (a_type y)\<rbrakk> \<Longrightarrow> ba y (KOArch (KOPDE pde'))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde'))) \<and> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ekheap_relation (ekheap a) ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; \<forall>x\<in>dom (ekheap a). \<exists>tcb'. ksPSpace b x = Some (KOTCB tcb') \<and> etcb_relation (the (ekheap a x)) tcb'; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ekheap a p = Some y; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ y. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; \<forall>x\<in>dom (ekheap a). \<exists>tcb'. ksPSpace b x = Some (KOTCB tcb') \<and> etcb_relation (the (ekheap a x)) tcb'; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y)); \<exists>tcb. kheap a p = Some (TCB tcb)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ tcb. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; \<forall>x\<in>dom (ekheap a). \<exists>tcb'. ksPSpace b x = Some (KOTCB tcb') \<and> etcb_relation (the (ekheap a x)) tcb'; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); \<forall>x\<in>dom (kheap a). \<forall>xa\<in>obj_relation_cuts (the (kheap a x)) x. case xa of (y, P) \<Rightarrow> P (the (kheap a x)) (the (ksPSpace b y)); kheap a p = Some (TCB tcb)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_ tcb. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; \<forall>x\<in>dom (ekheap a). \<exists>tcb'. ksPSpace b x = Some (KOTCB tcb') \<and> etcb_relation (the (ekheap a x)) tcb'; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_dom (kheap a) = dom (ksPSpace b); kheap a p = Some (TCB tcb); \<forall>x\<in>obj_relation_cuts (the (kheap a p)) p. case x of (y, P) \<Rightarrow> P (the (kheap a p)) (the (ksPSpace b y))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ghost_relation ((kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))) (gsUserPages b) (gsCNodes b)
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<forall>aa sz. (\<exists>dev. kheap a aa = Some (ArchObj (DataPage dev sz))) = (gsUserPages b aa = Some sz); \<forall>aa n. (\<exists>cs. kheap a aa = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> gsUserPages b (p && ~~ mask pd_bits) = None \<and> gsCNodes b (p && ~~ mask pd_bits) = None
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<forall>sz. (\<exists>dev. kheap a (p && ~~ mask pd_bits) = Some (ArchObj (DataPage dev sz))) = (gsUserPages b (p && ~~ mask pd_bits) = Some sz); \<forall>n. (\<exists>cs. kheap a (p && ~~ mask pd_bits) = Some (CNode n cs) \<and> well_formed_cnode_n n cs) = (gsCNodes b (p && ~~ mask pd_bits) = Some n)\<rbrakk> \<Longrightarrow> gsUserPages b (p && ~~ mask pd_bits) = None \<and> gsCNodes b (p && ~~ mask pd_bits) = None
 2. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> cdt_list_relation (cdt_list a) (cdt a) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (map_to_ctes ((ksPSpace b)(p \<mapsto> KOArch (KOPDE pde')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>)) (cdt a) (ctes_of b) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := (kheap a)(p && ~~ mask pd_bits \<mapsto> ArchObj (PageDirectory (pd(UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) := pde))))\<rparr>))) (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<And>a b uu_. \<lbrakk>pde_relation_aligned (p >> 2) pde pde'; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pspace_aligned a; valid_etcbs a; pde_at' p b; ksPSpace b p = Some (KOArch (KOPDE uu_)); is_aligned p 2; ps_clear p 2 b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (a\<lparr>kheap := \<lambda>x. if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (\<lambda>x. if x = UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) then pde else pd x))) else kheap a x\<rparr>)) (cdt a) (ctes_of b) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state (a\<lparr>kheap := \<lambda>x. if x = p && ~~ mask pd_bits then Some (ArchObj (PageDirectory (\<lambda>x. if x = UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) then pde else pd x))) else kheap a x\<rparr>))) (ctes_of b) proof (prove)
goal:
No subgoals!