theory ArchVSpace_AI

lemma set_pd_invs_map:
  "\<lbrace>invs and (\<lambda>s. \<forall>i. wellformed_pde (pd i)) and
     obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p and
     obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and
     obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd')
                  \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and
     (\<lambda>s. \<forall>(r,p) \<in> S. \<forall>ao. ko_at (ArchObj ao) p s \<longrightarrow> valid_vspace_obj ao s) and
     (\<lambda>s. \<forall>(r,p) \<in> S. page_table_at p s) and
     (\<lambda>s. \<forall>(r,p) \<in> S. (r \<in> kernel_vsrefs)
                         = (p \<in> set (arm_global_pts (arch_state s)))) and
     (\<lambda>s. \<exists>p' cap. caps_of_state s p' = Some cap \<and> is_pd_cap cap
                  \<and> p \<in> obj_refs cap \<and> cap_asid cap \<noteq> None) and
     (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and
     (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow>
              (\<forall>(r, p) \<in> S'. \<exists>p' cap. caps_of_state s p' = Some cap \<and> p \<in> obj_refs cap
                                       \<and> vs_cap_ref cap = Some (r # ref))) and
     (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow>
              (\<forall>(r, p) \<in> S. (\<forall>q' pt d.
                      ko_at (ArchObj (PageTable pt)) p s \<longrightarrow>
                      pte_ref_pages (pt d) = Some q' \<longrightarrow>
                      (\<exists>p' cap. caps_of_state s p' = Some cap \<and>
                                q' \<in> obj_refs cap \<and>
                                vs_cap_ref cap =
                                Some (VSRef (ucast d) (Some APageTable) # r # ref))))) and

     valid_vspace_obj (PageDirectory pd)\<rbrace>
  set_pd p pd \<lbrace>\<lambda>_. invs\<rbrace>" apply (simp add: invs_def valid_state_def valid_pspace_def) apply (rule hoare_pre) apply (wp set_pd_valid_objs set_pd_iflive set_pd_zombies
             set_pd_zombies_state_refs set_pd_valid_mdb set_pd_zombies_state_hyp_refs
             set_pd_valid_idle set_pd_ifunsafe set_pd_reply_caps
             set_pd_valid_arch set_pd_valid_global set_pd_cur
             set_pd_reply_masters valid_irq_node_typ
             set_pd_vspace_objs_map[where S=S and T="{}"]
             set_pd_valid_arch_caps[where S=S and T="{}" and S'=S' and T'=T']
             valid_irq_handlers_lift
             set_pd_valid_kernel_mappings_map[where S=S and T="{}"]
             set_pd_equal_kernel_mappings_triv) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (frule(1) valid_global_refsD2) apply (clarsimp simp: cap_range_def split_def) apply (rule conjI) apply clarsimp apply (drule (1) vs_refs_pages_pdI) apply (clarsimp simp: obj_at_def) apply (erule disjE) apply (clarsimp simp: valid_arch_caps_def) apply (drule valid_vs_lookupD[OF vs_lookup_pages_step]) apply (clarsimp simp: vs_lookup_pages1_def obj_at_def) apply (rule_tac x="VSRef (ucast c) (Some APageDirectory)" in exI) apply (erule conjI[OF refl]) apply simp apply clarsimp apply (erule_tac x=r in allE, drule (1) mp, drule (1) bspec) apply clarsimp apply (rule conjI) apply (clarsimp simp: pde_ref_def split: pde.splits) apply (drule (1) vs_refs_pdI2) apply (clarsimp simp: obj_at_def) apply (erule disjE) apply (clarsimp simp: valid_arch_caps_def) apply (drule valid_vs_lookupD[OF vs_lookup_pages_step[OF vs_lookup_pages_step]]) apply (clarsimp simp: vs_lookup_pages1_def obj_at_def) apply (rule_tac x="VSRef (ucast c) (Some APageDirectory)" in exI) apply (rule conjI[OF refl]) apply (erule subsetD[OF vs_refs_pages_subset]) apply (clarsimp simp: vs_lookup_pages1_def obj_at_def) apply (rule_tac x="VSRef (ucast d) (Some APageTable)" in exI) apply (rule conjI[OF refl]) apply (erule pte_ref_pagesD) apply simp apply clarsimp apply (erule_tac x=r in allE, drule (1) mp, drule_tac P="(%x. \<forall>q' pt . Q x q' pt y s)" for Q s in bspec) apply simp apply clarsimp apply (rule conjI) apply clarsimp apply (clarsimp simp add: obj_at_def glob_vs_refs_def) apply safe[1] apply (rule pair_imageI) apply (clarsimp simp add: graph_of_def) apply (case_tac "ab \<in> kernel_mapping_slots") apply clarsimp apply (frule (1) pde_graph_ofI[rotated]) apply (case_tac "pd ab", simp_all) apply (clarsimp simp: vs_refs_def ) apply (drule_tac x="(ab, bb)" and f="(\<lambda>(r, y). (VSRef (ucast r) (Some APageDirectory), y))"
             in imageI) apply simp apply (erule imageE) apply (simp add: graph_of_def split_def) apply (rule pair_imageI) apply (case_tac "ab \<in> kernel_mapping_slots") apply (clarsimp simp add: graph_of_def)+ apply (frule (1) pde_graph_ofI[rotated]) apply (case_tac "pd ab", simp_all) apply (clarsimp simp: vs_refs_def ) apply (drule_tac x="(ab, bb)" and f="(\<lambda>(r, y). (VSRef (ucast r) (Some APageDirectory), y))"
             in imageI) apply (drule_tac s="(\<lambda>(r, y). (VSRef (ucast r) (Some APageDirectory), y)) `
        graph_of
         (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))" in sym) apply simp apply (drule_tac c="(VSRef (ucast ab) (Some APageDirectory), bb)" and B=S in UnI1) apply simp apply (erule imageE) apply (simp add: graph_of_def split_def) apply (subst (asm) Un_commute[where B=S]) apply (drule_tac c="(aa,ba)" and B="vs_refs (ArchObj (PageDirectory pd'))" in UnI1) apply (drule_tac t="S \<union> vs_refs (ArchObj (PageDirectory pd'))" in sym) apply (simp del:Un_iff) apply (drule rev_subsetD[OF _ glob_vs_refs_subset]) apply (simp add: glob_vs_refs_def) by blast

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and (\<lambda>s. \<forall>i. wellformed_pde (pd i)) and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and (\<lambda>s. \<forall>(r, p)\<in>S. \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. \<forall>(r, p)\<in>S. typ_at (AArch APageTable) p s) and (\<lambda>s. \<forall>(r, p)\<in>S. (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s)))) and (\<lambda>s. \<exists>p' cap. caps_of_state s p' = Some cap \<and> is_pd_cap cap \<and> p \<in> obj_refs cap \<and> cap_asid cap \<noteq> None) and (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>(r, p)\<in>S'. \<exists>p' cap. caps_of_state s p' = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref))) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>(r, p)\<in>S. \<forall>q' pt d. ako_at (PageTable pt) p s \<longrightarrow> pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref)))) and valid_vspace_obj (PageDirectory pd)\<rbrace> set_pd p pd \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and (\<lambda>s. \<forall>i. wellformed_pde (pd i)) and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> typ_at (AArch APageTable) p s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s)))) and (\<lambda>s. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pd_cap cap \<and> p \<in> obj_refs cap \<and> (\<exists>y. cap_asid cap = Some y)) and (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. case x of (r, p) \<Rightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref))) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>q' pt. ako_at (PageTable pt) p s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref))))) and (\<lambda>s. \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s)\<rbrace> set_pd p pd \<lbrace>\<lambda>_. valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q14\<rbrace> set_pd p pd \<lbrace>\<lambda>_. valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb\<rbrace>
 2. \<And>s. (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and (\<lambda>s. \<forall>i. wellformed_pde (pd i)) and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> typ_at (AArch APageTable) p s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s)))) and (\<lambda>s. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pd_cap cap \<and> p \<in> obj_refs cap \<and> (\<exists>y. cap_asid cap = Some y)) and (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. case x of (r, p) \<Rightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref))) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>q' pt. ako_at (PageTable pt) p s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref))))) and (\<lambda>s. \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s)) s \<Longrightarrow> ?Q14 s proof (prove)
goal (1 subgoal):
 1. \<And>s. (valid_objs and pspace_aligned and pspace_distinct and if_live_then_nonz_cap and zombies_final and (\<lambda>s. sym_refs (state_refs_of s)) and (\<lambda>s. sym_refs (state_hyp_refs_of s)) and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and (\<lambda>s. \<forall>i. wellformed_pde (pd i)) and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> typ_at (AArch APageTable) p s) and (\<lambda>s. \<forall>x\<in>S. case x of (r, p) \<Rightarrow> (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s)))) and (\<lambda>s. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pd_cap cap \<and> p \<in> obj_refs cap \<and> (\<exists>y. cap_asid cap = Some y)) and (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. case x of (r, p) \<Rightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref))) and (\<lambda>s. \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>q' pt. ako_at (PageTable pt) p s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref))))) and (\<lambda>s. \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s)) s \<Longrightarrow> ((\<lambda>s. \<forall>i. wellformed_pde (pd i)) and valid_objs) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> if_live_then_nonz_cap s \<and> zombies_final s \<and> sym_refs (state_refs_of s) \<and> sym_refs (state_hyp_refs_of s) \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> (valid_vspace_objs and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - {} \<union> S) p and (\<lambda>s. \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) and (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> valid_vspace_obj (PageDirectory pd) s)) s \<and> (valid_arch_caps and valid_arch_state and valid_vspace_objs and valid_objs and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - {} \<union> S) p and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and (\<lambda>s. \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) and (\<lambda>s. \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S) and (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> valid_vspace_obj (PageDirectory pd) s) and (\<lambda>s. (\<exists>p' cap. caps_of_state s p' = Some cap \<and> is_pd_cap cap \<and> p \<in> obj_refs cap \<and> cap_asid cap \<noteq> None) \<or> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)))) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt d. ako_at (PageTable pt) q s \<longrightarrow> pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) s \<and> (valid_global_objs and valid_global_refs and valid_arch_state and (\<lambda>s. (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd))) \<or> (\<exists>slot. cte_wp_at (\<lambda>cap. p \<in> obj_refs cap) slot s))) s \<and> (valid_kernel_mappings and obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko - {} \<union> S) p and (\<lambda>s. \<forall>(r, p)\<in>S. (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s))))) s \<and> (obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p and equal_kernel_mappings) s \<and> valid_asid_map s \<and> (valid_global_vspace_mappings s \<and> valid_global_objs s \<and> p \<notin> global_refs s) \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> typ_at (AArch APageTable) p s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. case x of (r, p) \<Rightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>q' pt. ako_at (PageTable pt) p s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y\<rbrakk> \<Longrightarrow> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) \<and> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>ao. ako_at ao p s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> typ_at (AArch APageTable) p s; \<forall>x\<in>S. case x of (r, p) \<Rightarrow> (r \<in> kernel_vsrefs) = (p \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. case x of (r, p) \<Rightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some (r # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. case x of (r, p) \<Rightarrow> \<forall>q' pt. ako_at (PageTable pt) p s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # r # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> cap_range cap = {}\<rbrakk> \<Longrightarrow> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) \<and> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) \<and> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c q. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; pde_ref_pages (pd c) = Some q\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c q. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')) \<and> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T' \<or> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')) \<and> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((r, p), ?ref214 s a b cap y r c q pd', ?p214 s a b cap y r c q pd') \<in> vs_lookup_pages1 s
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p214 s a b cap y r c q pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref214 s a b cap y r c q pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> \<exists>ra. ?ref214 s a b cap y r c q pd' = ra # r \<and> (ra, ?p214 s a b cap y r c q pd') \<in> vs_refs_pages (ArchObj (PageDirectory pd'))
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p214 s a b cap y r c q pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref214 s a b cap y r c q pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ?ref214 s a b cap y r c q pd' = VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r \<and> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ?p214 s a b cap y r c q pd') \<in> vs_refs_pages (ArchObj (PageDirectory pd'))
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p214 s a b cap y r c q pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref214 s a b cap y r c q pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot cap. caps_of_state s slot = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; valid_vs_lookup s; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> vs_refs_pages (ArchObj (PageDirectory pd')); (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<notin> T'; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot cap. caps_of_state s slot = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c q pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> S'; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), q) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (\<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))) \<and> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c x21 x22 x23 q' pt d. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; pd c = PageTablePDE x21 x22 x23; ako_at (PageTable pt) (ptrFromPAddr x21) s; pte_ref_pages (pt d) = Some q'\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c x21 x22 x23 q' pt d. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; ako_at (PageTable pt) (ptrFromPAddr x21) s; pte_ref_pages (pt d) = Some q'; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')) \<or> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd'))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (6 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((r, p), ?refa282 s a b cap y r c x21 q' pt d pd', ?pa282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((?refa282 s a b cap y r c x21 q' pt d pd', ?pa282 s a b cap y r c x21 q' pt d pd'), ?ref282 s a b cap y r c x21 q' pt d pd', ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 6. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (6 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> \<exists>ra. ?refa282 s a b cap y r c x21 q' pt d pd' = ra # r \<and> (ra, ?pa282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageDirectory pd'))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((?refa282 s a b cap y r c x21 q' pt d pd', ?pa282 s a b cap y r c x21 q' pt d pd'), ?ref282 s a b cap y r c x21 q' pt d pd', ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 6. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (6 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ?refa282 s a b cap y r c x21 q' pt d pd' = VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r \<and> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ?pa282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageDirectory pd'))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((?refa282 s a b cap y r c x21 q' pt d pd', ?pa282 s a b cap y r c x21 q' pt d pd'), ?ref282 s a b cap y r c x21 q' pt d pd', ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 6. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (6 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ?pa282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageDirectory pd'))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r, ?pa282 s a b cap y r c x21 q' pt d pd'), ?ref282 s a b cap y r c x21 q' pt d pd', ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 6. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ((VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r, ptrFromPAddr x21), ?ref282 s a b cap y r c x21 q' pt d pd', ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_lookup_pages1 s
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> \<exists>ra. ?ref282 s a b cap y r c x21 q' pt d pd' = ra # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r \<and> (ra, ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageTable pt))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> ?ref282 s a b cap y r c x21 q' pt d pd' = VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r \<and> (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageTable pt))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (?ref282 s a b cap y r c x21 q' pt d pd')\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), ?p282 s a b cap y r c x21 q' pt d pd') \<in> vs_refs_pages (ArchObj (PageTable pt))
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot capa. caps_of_state s slot = Some capa \<and> ?p282 s a b cap y r c x21 q' pt d pd' \<in> obj_refs capa \<and> vs_cap_ref capa = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 5. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s)\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot cap. caps_of_state s slot = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 4. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> vs_refs (ArchObj (PageDirectory pd')); valid_vs_lookup s; valid_table_caps s; unique_table_caps (caps_of_state s); unique_table_refs (caps_of_state s); \<exists>slot cap. caps_of_state s slot = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S\<rbrakk> \<Longrightarrow> ?x306 s a b cap y r c x21 q' pt d pd' \<in> S
 2. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S; \<forall>q'a pta. kheap s (snd (?x306 s a b cap y r c x21 q' pt d pd')) = Some (ArchObj (PageTable pta)) \<longrightarrow> (\<forall>da. pte_ref_pages (pta da) = Some q'a \<longrightarrow> (\<exists>aa ba capa. caps_of_state s (aa, ba) = Some capa \<and> q'a \<in> obj_refs capa \<and> vs_cap_ref capa = Some (VSRef (UCAST(8 \<rightarrow> 32) da) (Some APageTable) # fst (?x306 s a b cap y r c x21 q' pt d pd') # r)))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 3. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y r c x21 q' pt d pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (r \<unrhd> p) s; c \<notin> kernel_mapping_slots; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some q'; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) \<in> S; \<forall>q' pt. kheap s (snd (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21)) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), ptrFromPAddr x21) # r)))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> (obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)) \<and> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> obj_at (empty_table (set (second_level_tables (arch_state s)))) p s \<longrightarrow> empty_table (set (second_level_tables (arch_state s))) (ArchObj (PageDirectory pd)) \<or> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap)
 2. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko \<union> S) p s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; obj_at (\<lambda>ko. \<exists>pd'. ko = ArchObj (PageDirectory pd') \<and> (\<forall>x\<in>kernel_mapping_slots. pd x = pd' x)) p s; \<forall>x\<in>S. \<forall>ao. ako_at ao (snd x) s \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. ako_at (PageTable pt) (snd x) s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. glob_vs_refs (ArchObj (PageDirectory pd)) = glob_vs_refs ko \<union> S) p s \<and> p \<notin> global_refs s proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x\<rbrakk> \<Longrightarrow> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd') \<union> S \<and> p \<notin> global_refs s proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd); (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd')
 2. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd); (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S\<rbrakk> \<Longrightarrow> (ab, bb) \<in> graph_of (pde_ref \<circ> pd')
 2. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 3. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 5. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> ?pd356 s a b cap y pd' ab bb ab = pd ab
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (?pd356 s a b cap y pd' ab bb x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 3. \<And>s a b cap y pd' aa ba ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 5. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (case (ab, bb) of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb x. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd ab) = Some bb; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<notin> S; ab \<notin> kernel_mapping_slots; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) = (case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)); x \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x))\<rbrakk> \<Longrightarrow> pde_ref (pd' ab) = Some bb
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd')\<rbrakk> \<Longrightarrow> (ab, bb) \<in> graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd'); ab \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> (ab, bb) \<in> graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (ab, bb) \<in> graph_of (pde_ref \<circ> pd'); ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> (ab, bb) \<in> graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> ?pd372 s a b cap y pd' ab bb ab = pd' ab
 2. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (?pd372 s a b cap y pd' ab bb x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 3. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 4. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (ab, bb) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)) = (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (case (ab, bb) of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (case (ab, bb) of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) \<in> (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)); (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S = (\<lambda>(r, y). (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)); (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S = (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S = (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)); (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S = (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)); (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) \<in> (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>s a b cap y pd' ab bb x. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; pde_ref (pd' ab) = Some bb; ab \<notin> kernel_mapping_slots; (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd' x)) \<union> S = (\<lambda>x. case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x)); (VSRef (UCAST(12 \<rightarrow> 32) ab) (Some APageDirectory), bb) = (case x of (r, y) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), y)); x \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pd x))\<rbrakk> \<Longrightarrow> pde_ref (pd ab) = Some bb
 2. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 3. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = S \<union> vs_refs (ArchObj (PageDirectory pd')); vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = S \<union> vs_refs (ArchObj (PageDirectory pd')); vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S \<union> vs_refs (ArchObj (PageDirectory pd'))\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> S \<union> vs_refs (ArchObj (PageDirectory pd')); S \<union> vs_refs (ArchObj (PageDirectory pd')) = vs_refs (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; (aa, ba) \<in> vs_refs (ArchObj (PageDirectory pd)); S \<union> vs_refs (ArchObj (PageDirectory pd')) = vs_refs (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>s a b cap y pd' aa ba. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; S \<union> vs_refs (ArchObj (PageDirectory pd')) = vs_refs (ArchObj (PageDirectory pd)); (aa, ba) \<in> glob_vs_refs (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> (aa, ba) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (pde_ref \<circ> pd)
 2. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s a b cap y pd'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>i. wellformed_pde (pd i); \<forall>x\<in>S. \<forall>ao. kheap s (snd x) = Some (ArchObj ao) \<longrightarrow> valid_vspace_obj ao s; \<forall>x\<in>S. \<exists>ko. kheap s (snd x) = Some ko \<and> a_type ko = AArch APageTable; \<forall>x\<in>S. (fst x \<in> kernel_vsrefs) = (snd x \<in> set (arm_global_pts (arch_state s))); \<forall>p. (VSRef 0 (Some AASIDPool), p) \<notin> S; caps_of_state s (a, b) = Some cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S'. \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> snd x \<in> obj_refs cap \<and> vs_cap_ref cap = Some (fst x # ref)); is_pd_cap cap; \<forall>ref. (ref \<unrhd> p) s \<longrightarrow> (\<forall>x\<in>S. \<forall>q' pt. kheap s (snd x) = Some (ArchObj (PageTable pt)) \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # fst x # ref)))); \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s; p \<in> obj_refs cap; cap_asid cap = Some y; global_refs s \<inter> (untyped_range cap \<union> obj_refs cap) = {}; vs_refs (ArchObj (PageDirectory pd)) = vs_refs (ArchObj (PageDirectory pd')) \<union> S; vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages (ArchObj (PageDirectory pd')) - T' \<union> S'; kheap s p = Some (ArchObj (PageDirectory pd')); \<forall>x\<in>kernel_mapping_slots. pd x = pd' x; p \<in> global_refs s\<rbrakk> \<Longrightarrow> False