theory ArchAcc_R

lemma get_master_pte_corres [@lift_corres_args, corres]:
  "corres pte_relation' (pte_at p)
     (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and
      pspace_aligned' and pspace_distinct')
     (get_master_pte p) (getObject p)" proof - have [simp]: "max pt_bits 6 = pt_bits" by (simp add:pd_bits_def pageBits_def pt_bits_def) have expand: "p && ~~ mask pt_bits = (p && ~~ mask 6) && ~~ mask pt_bits" by (simp add: and_not_mask_twice) have [simp]: "is_aligned (p && ~~ mask 6 >> 2) 4" apply (rule is_aligned_shiftr) apply (simp add:is_aligned_neg_mask) done show ?thesis apply (simp add: getObject_def get_pte_def get_pt_def  get_object_def
      split_def bind_assoc pte_relation_aligned_def get_master_pte_def) apply (rule corres_no_failI) apply (rule no_fail_pre, wp) apply (clarsimp simp: ko_wp_at'_def typ_at'_def lookupAround2_known1) apply (case_tac ko, simp_all)[1] apply (rename_tac arch_kernel_object) apply (case_tac arch_kernel_object, simp_all add: projectKOs)[1] apply (clarsimp simp: objBits_def cong: option.case_cong) apply (erule (1) ps_clear_lookupAround2) apply simp apply (erule is_aligned_no_overflow) apply (simp add: objBits_simps archObjSize_def word_bits_def) apply simp apply (clarsimp simp: in_monad loadObject_default_def
      projectKOs and_not_mask_twice) apply (simp add: bind_assoc exec_gets) apply (clarsimp simp: pte_at_def obj_at_def) apply (clarsimp split:ARM_A.pte.splits) apply (intro conjI impI)
  \<comment> \<open>master_pde = InvaliatePTE\<close> apply (clarsimp simp add: a_type_def return_def get_pt_def
                  bind_def get_pte_def get_object_def gets_def get_def
                  split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pteBits_def) apply (clarsimp simp:state_relation_def) apply (frule_tac x = "(ucast (p && mask pt_bits >> 2))" in pte_relation_alignedD) apply assumption apply (simp add:mask_pt_bits_inner_beauty) apply (clarsimp simp:pte_relation_aligned_def
        split:if_splits ARM_H.pte.splits) apply (drule_tac p' = "p && ~~ mask 6" in valid_duplicates'_D[rotated]) apply (simp add:is_aligned_weaken[where y = 2] is_aligned_neg_mask) apply (clarsimp simp: vs_ptr_align_def) apply (simp add:and_not_mask_twice) apply (frule_tac x = "(ucast ((p && ~~ mask 6) && mask pt_bits >> 2))" in pte_relation_alignedD) apply assumption apply (simp add:expand) apply (subst mask_pt_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (clarsimp simp: pte_relation_aligned_def
                 is_aligned_mask[where 'a=32, symmetric])
  \<comment> \<open>master_pde = LargePagePTE\<close> apply (clarsimp simp add: a_type_def return_def get_pt_def
       bind_def get_pte_def get_object_def gets_def get_def
       split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pteBits_def) apply (clarsimp simp:state_relation_def) apply (drule_tac s = a and s' = b and p = "p && ~~ mask 6"
      in aligned_distinct_relation_pte_atI'[rotated -1]) apply (clarsimp simp:pte_at_def obj_at_def
          and_not_mask_twice a_type_simps is_aligned_neg_mask) apply simp apply simp apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (case_tac ko; simp) apply (rename_tac arch_kernel_object) apply (case_tac arch_kernel_object, simp_all add: projectKOs)[1] apply clarsimp apply (frule_tac x = "(ucast ((p && ~~ mask 6 )&& mask pt_bits >> 2))" in pte_relation_alignedD) apply assumption apply (simp add: expand) apply (subst mask_pt_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (rename_tac pte) apply (case_tac pte) apply (simp_all add:pte_relation_aligned_def is_aligned_mask[symmetric]) apply (drule_tac p = "p && ~~ mask 6" and p' = p  in valid_duplicates'_D) apply assumption apply simp apply (clarsimp simp: vs_ptr_align_def and_not_mask_twice) apply (clarsimp simp: if_bool_eq_disj)
  \<comment> \<open>master_pde = SmallPagePTE\<close> apply (clarsimp simp add: a_type_def return_def get_pt_def
               bind_def get_pte_def get_object_def gets_def get_def
            split: if_split_asm Structures_A.kernel_object.splits
                   arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps
                         archObjSize_def pageBits_def pteBits_def) apply (clarsimp simp:state_relation_def) apply (frule_tac x = "(ucast (p && mask pt_bits >> 2))"
                 in pte_relation_alignedD) apply assumption apply (simp add:mask_pt_bits_inner_beauty) apply (clarsimp simp:pte_relation_aligned_def
     split:if_splits ARM_H.pte.splits) apply (drule_tac p' = "p && ~~ mask 6" in valid_duplicates'_D[rotated]) apply (simp add:is_aligned_weaken[where y = 2] is_aligned_neg_mask) apply (clarsimp simp: vs_ptr_align_def) apply (simp add:and_not_mask_twice) apply (drule_tac x = "(ucast ((p && ~~ mask 6) && mask pt_bits >> 2))"
                 in pte_relation_alignedD) apply assumption apply (simp add: expand) apply (subst mask_pt_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (clarsimp simp: pte_relation_aligned_def
                         is_aligned_mask[where 'a=32, symmetric]) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (state)
goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (prove)
goal (1 subgoal):
 1. max pt_bits 6 = pt_bits proof (state)
this:
max pt_bits 6 = pt_bits

goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (prove)
goal (1 subgoal):
 1. p && ~~ mask pt_bits = (p && ~~ mask 6) && ~~ mask pt_bits proof (state)
this:
p && ~~ mask pt_bits = (p && ~~ mask 6) && ~~ mask pt_bits

goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (prove)
goal (1 subgoal):
 1. is_aligned (p && ~~ mask 6 >> 2) 4 proof (prove)
goal (1 subgoal):
 1. is_aligned (p && ~~ mask 6) (4 + 2) proof (prove)
goal:
No subgoals! proof (state)
this:
is_aligned (p && ~~ mask 6 >> 2) 4

goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (prove)
goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p) proof (prove)
goal (1 subgoal):
 1. corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) (do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) proof (prove)
goal (2 subgoals):
 1. True \<Longrightarrow> no_fail (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od)
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>True; (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. fst (lookupAround2 p (ksPSpace s)) \<noteq> None) and (\<lambda>sa. fst (lookupAround2 p (ksPSpace s)) \<noteq> None \<longrightarrow> (\<exists>obj. projectKO_opt (snd (the (fst (lookupAround2 p (ksPSpace s))))) = Some obj \<and> is_aligned p (objBits obj) \<and> fst (the (fst (lookupAround2 p (ksPSpace s)))) = p \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)))) s)) s
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some ko; pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO ko); koTypeOf ko = ArchT PTET; ps_clear p (objBitsKO ko) s\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt ko = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko x8. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch x8); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch x8)); archTypeOf x8 = PTET; ps_clear p (objBitsKO (KOArch x8)) s; ko = KOArch x8\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt (KOArch x8) = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch arch_kernel_object); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch arch_kernel_object)); archTypeOf arch_kernel_object = PTET; ps_clear p (objBitsKO (KOArch arch_kernel_object)) s; ko = KOArch arch_kernel_object\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt (KOArch arch_kernel_object) = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2))); ps_clear p (objBitsKO (KOArch (KOPTE x2))) s; ko = KOArch (KOPTE x2); arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> is_aligned p (objBits x2) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits x2 \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2))); ps_clear p (objBitsKO (KOArch (KOPTE x2))) s\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2)))\<rbrakk> \<Longrightarrow> p \<le> p
 2. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2)))\<rbrakk> \<Longrightarrow> p \<le> p + 2 ^ objBitsKO (KOArch (KOPTE x2)) - 1
 3. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPTE x2)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p
 4. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (3 subgoals):
 1. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2)))\<rbrakk> \<Longrightarrow> p \<le> p + 2 ^ objBitsKO (KOArch (KOPTE x2)) - 1
 2. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPTE x2)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p
 3. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s x2. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPTE x2)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPTE x2))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPTE x2)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPTE x2)) \<le> x - p
 2. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<forall>(s, s')\<in>state_relation. pte_at p s \<and> (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> pte_at p s \<and> pte_at' p s' \<and> vs_valid_duplicates' (ksPSpace s') \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<longrightarrow> (\<forall>x\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pt_bits) = Some y);
pt <- case the (x ((p && ~~ mask 6) && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> pte_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(a, b) \<in> state_relation; pte_at p a; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x (p && ~~ mask pt_bits) = Some y);
pt <- case the (x (p && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(a, b) \<in> state_relation; pte_at p a; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- assert (\<exists>y. kheap a (p && ~~ mask pt_bits) = Some y);
pt <- case the (kheap a (p && ~~ mask pt_bits)) of ArchObj (PageTable xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((case pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) of ARM_A.LargePagePTE x xa xb \<Rightarrow> return (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) | _ \<Rightarrow> get_pte p) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE \<longrightarrow> (\<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)) \<and> (\<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)) \<and> ((\<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33) \<longrightarrow> (\<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; is_aligned p (objBitsKO (KOArch (KOPTE aa))); ps_clear p (objBitsKO (KOArch (KOPTE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'91 a b aa pt))
 2. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace (?s'91 a b aa pt) ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte91 a b aa pt)))
 3. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) (?pte91 a b aa pt)\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte91 a b aa pt)))
 2. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) (?pte91 a b aa pt)\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (6 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))))
 3. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 4. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 6. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))))
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 3. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'134 a b pt x21 x22 x23 x24 x25))
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace (?s'134 a b pt x21 x22 x23 x24 x25) ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte134 a b pt x21 x22 x23 x24 x25)))
 3. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte134 a b pt x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte134 a b pt x21 x22 x23 x24 x25)))
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte134 a b pt x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte134 a b pt x21 x22 x23 x24 x25)))
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte134 a b pt x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte137 a b pt x21 x22 x23 x24 x25 (?a137 a b pt x21 x22 x23 x24 x25) b (?pt137 a b pt x21 x22 x23 x24 x25) (?x21.137 a b pt x21 x22 x23 x24 x25) (?x22.137 a b pt x21 x22 x23 x24 x25) (?x23.137 a b pt x21 x22 x23 x24 x25) (?x24.137 a b pt x21 x22 x23 x24 x25) (?x25.137 a b pt x21 x22 x23 x24 x25))))
 3. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte137 a b pt x21 x22 x23 x24 x25 (?a137 a b pt x21 x22 x23 x24 x25) b (?pt137 a b pt x21 x22 x23 x24 x25) (?x21.137 a b pt x21 x22 x23 x24 x25) (?x22.137 a b pt x21 x22 x23 x24 x25) (?x23.137 a b pt x21 x22 x23 x24 x25) (?x24.137 a b pt x21 x22 x23 x24 x25) (?x25.137 a b pt x21 x22 x23 x24 x25))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte137 a b pt x21 x22 x23 x24 x25 (?a137 a b pt x21 x22 x23 x24 x25) b (?pt137 a b pt x21 x22 x23 x24 x25) (?x21.137 a b pt x21 x22 x23 x24 x25) (?x22.137 a b pt x21 x22 x23 x24 x25) (?x23.137 a b pt x21 x22 x23 x24 x25) (?x24.137 a b pt x21 x22 x23 x24 x25) (?x25.137 a b pt x21 x22 x23 x24 x25))))
 2. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte137 a b pt x21 x22 x23 x24 x25 (?a137 a b pt x21 x22 x23 x24 x25) b (?pt137 a b pt x21 x22 x23 x24 x25) (?x21.137 a b pt x21 x22 x23 x24 x25) (?x22.137 a b pt x21 x22 x23 x24 x25) (?x23.137 a b pt x21 x22 x23 x24 x25) (?x24.137 a b pt x21 x22 x23 x24 x25) (?x25.137 a b pt x21 x22 x23 x24 x25))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.InvalidPTE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (ARM_H.LargePagePTE x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<forall>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.LargePagePTE x21 x22 x23) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pt x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pt x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; is_aligned p (objBitsKO (KOArch (KOPTE aa))); ps_clear p (objBitsKO (KOArch (KOPTE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pte_at (p && ~~ mask 6) a
 2. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace b)
 3. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 4. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace b)
 2. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 3. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 ko. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some ko; is_aligned (p && ~~ mask 6) (objBitsKO ko); koTypeOf ko = ArchT PTET; ps_clear (p && ~~ mask 6) (objBitsKO ko) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 ko x8. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch x8); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch x8)); archTypeOf x8 = PTET; ps_clear (p && ~~ mask 6) (objBitsKO (KOArch x8)) b; ko = KOArch x8\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 ko arch_kernel_object. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch arch_kernel_object); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch arch_kernel_object)); archTypeOf arch_kernel_object = PTET; ps_clear (p && ~~ mask 6) (objBitsKO (KOArch arch_kernel_object)) b; ko = KOArch arch_kernel_object\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 ko arch_kernel_object x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; ko = KOArch (KOPTE x2); arch_kernel_object = KOPTE x2\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'203 a b aa pt x21 x22 x23 x2))
 2. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> ksPSpace (?s'203 a b aa pt x21 x22 x23 x2) ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte203 a b aa pt x21 x22 x23 x2)))
 3. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte203 a b aa pt x21 x22 x23 x2)\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte203 a b aa pt x21 x22 x23 x2)))
 2. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte203 a b aa pt x21 x22 x23 x2)\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte203 a b aa pt x21 x22 x23 x2)))
 2. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte203 a b aa pt x21 x22 x23 x2)\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte206 a b aa pt x21 x22 x23 x2 (?a206 a b aa pt x21 x22 x23 x2) b (?aa206 a b aa pt x21 x22 x23 x2) (?pt206 a b aa pt x21 x22 x23 x2) (?x21.206 a b aa pt x21 x22 x23 x2) (?x22.206 a b aa pt x21 x22 x23 x2) (?x23.206 a b aa pt x21 x22 x23 x2) (?x2.206 a b aa pt x21 x22 x23 x2))))
 3. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte206 a b aa pt x21 x22 x23 x2 (?a206 a b aa pt x21 x22 x23 x2) b (?aa206 a b aa pt x21 x22 x23 x2) (?pt206 a b aa pt x21 x22 x23 x2) (?x21.206 a b aa pt x21 x22 x23 x2) (?x22.206 a b aa pt x21 x22 x23 x2) (?x23.206 a b aa pt x21 x22 x23 x2) (?x2.206 a b aa pt x21 x22 x23 x2))\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte206 a b aa pt x21 x22 x23 x2 (?a206 a b aa pt x21 x22 x23 x2) b (?aa206 a b aa pt x21 x22 x23 x2) (?pt206 a b aa pt x21 x22 x23 x2) (?x21.206 a b aa pt x21 x22 x23 x2) (?x22.206 a b aa pt x21 x22 x23 x2) (?x23.206 a b aa pt x21 x22 x23 x2) (?x2.206 a b aa pt x21 x22 x23 x2))))
 2. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte206 a b aa pt x21 x22 x23 x2 (?a206 a b aa pt x21 x22 x23 x2) b (?aa206 a b aa pt x21 x22 x23 x2) (?pt206 a b aa pt x21 x22 x23 x2) (?x21.206 a b aa pt x21 x22 x23 x2) (?x22.206 a b aa pt x21 x22 x23 x2) (?x23.206 a b aa pt x21 x22 x23 x2) (?x2.206 a b aa pt x21 x22 x23 x2))\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 x2. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE x2)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE x2))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) x2\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE pte)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) pte\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE pte)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) pte; pte = ARM_H.InvalidPTE\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa pt x21 x22 x23 pte x21a x22a x23a x24 x25. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE pte)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) pte; pte = ARM_H.LargePagePTE x21a x22a x23a x24 x25\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa pt x21 x22 x23 pte x31 x32 x33 x34 x35. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE pte)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE pte))) b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) pte; pte = ARM_H.SmallPagePTE x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (5 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (?ko209 a b aa pt x21 x22 x23 pte x21a)
 2. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> is_aligned p 2
 3. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (?ko209 a b aa pt x21 x22 x23 pte x21a)) = p && ~~ mask (vs_ptr_align (?ko209 a b aa pt x21 x22 x23 pte x21a))
 4. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23); ksPSpace b p = Some (?ko209 a b aa pt x21 x22 x23 pte x21a)\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 5. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> is_aligned p 2
 2. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) = p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))))
 3. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23); ksPSpace b p = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 4. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) = p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))))
 2. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23); ksPSpace b p = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 3. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x21 x22 x23 pte x21a. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.LargePagePTE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))) b; x21a = x21; pte = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23); ksPSpace b p = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23))))\<rbrakk> \<Longrightarrow> aa = ARM_H.LargePagePTE x21 (PageCacheable \<in> x22) (Global \<in> x22) (XNever \<in> x22) (vmrights_map x23)
 2. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pt. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pte p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pte_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pt x31 x32 x33. \<lbrakk>(a, b) \<in> state_relation; pte_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pt x31 x32 x33. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; is_aligned p (objBitsKO (KOArch (KOPTE aa))); ps_clear p (objBitsKO (KOArch (KOPTE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pt x31 x32 x33. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'232 a b aa pt x31 x32 x33))
 2. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace (?s'232 a b aa pt x31 x32 x33) ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte232 a b aa pt x31 x32 x33)))
 3. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) (?pte232 a b aa pt x31 x32 x33)\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte232 a b aa pt x31 x32 x33)))
 2. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) (?pte232 a b aa pt x31 x32 x33)\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pt x31 x32 x33. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pte_relation_aligned (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa\<rbrakk> \<Longrightarrow> pte_relation' (pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2))) aa proof (prove)
goal (1 subgoal):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))))
 3. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 4. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))))
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 3. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'273 a b pt x31 x32 x33 x21 x22 x23 x24 x25))
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace (?s'273 a b pt x31 x32 x33 x21 x22 x23 x24 x25) ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)))
 3. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)))
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pt_bits) + (UCAST(8 \<rightarrow> 32) (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) << 2)) = Some (KOArch (KOPTE (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)))
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte273 a b pt x31 x32 x33 x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte276 a b pt x31 x32 x33 x21 x22 x23 x24 x25 (?a276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) b (?pt276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x31.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x32.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x33.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x21.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x22.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x23.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x24.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x25.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25))))
 3. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte276 a b pt x31 x32 x33 x21 x22 x23 x24 x25 (?a276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) b (?pt276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x31.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x32.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x33.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x21.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x22.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x23.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x24.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x25.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (?pte276 a b pt x31 x32 x33 x21 x22 x23 x24 x25 (?a276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) b (?pt276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x31.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x32.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x33.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x21.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x22.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x23.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x24.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x25.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25))))
 2. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (?pte276 a b pt x31 x32 x33 x21 x22 x23 x24 x25 (?a276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) b (?pt276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x31.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x32.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x33.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x21.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x22.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x23.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x24.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25) (?x25.276 a b pt x31 x32 x33 x21 x22 x23 x24 x25))\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>a b pt x31 x32 x33 x21 x22 x23 x24 x25. \<lbrakk>pt (UCAST(32 \<rightarrow> 8) (p && mask pt_bits >> 2)) = ARM_A.InvalidPTE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) = ARM_A.SmallPagePTE x31 x32 x33; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPTE (ARM_H.LargePagePTE x21 x22 x23 x24 x25))); pte_relation_aligned (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2)) (pt (UCAST(32 \<rightarrow> 8) ((p && ~~ mask 6) && mask pt_bits >> 2))) (ARM_H.LargePagePTE x21 x22 x23 x24 x25)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
corres pte_relation' (pte_at p) (pte_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pte p) (getObject p)

goal:
No subgoals!